[Bro] Question regarding TCP behavior

[Vern Paxson]

> When a TCP end point (A) sends x bytes of data to the other end point (B),
> does B immediately ACK the received bytes or will it do so only when the data
> is passed to the upper layer ?

To first order, the former.  ACKs are generated by the TCP stack as it is
able to place data in sequence, with some rules for delaying certain ACKs
by a small amount in hope that more data will arrive in sequence that can
also be covered by a single ACK.  Generation of an ACK does *not* mean
that the upper layer has consumed it.  (In fact you can glean whether or
not it did based on whether the offered window changes.  If it doesn't,
but the ACK advances the sequence point, then presumably the upper layer
consumed it.)

		Vern