[Bro] TCP Sack processing

Adayadil Thomas adayadil.thomas at gmail.com
Tue Aug 9 13:53:23 PDT 2005

Thanks for the reply.

>>SACKs are advisory, not guarantees
Could you be a little more elaborate on that. or point me to some rfc
or other doc ?

Thanks a lot

On 8/9/05, Vern Paxson <vern at icir.org> wrote:
> > Does TCP stream reassembly algorithm need TCP SACK processing for completeness ?
> No.  SACKs are advisory, not guarantees, and can be ignored for purposes
> of stream reassembly.
>                 Vern

More information about the Bro mailing list