TCP Delay Ack Detect

TCP Dealy Ack may cause performance issue. Below is an example for vmware esxi cluster with iscsi connections.

https://knowledge.broadcom.com/external/article/313543/esxesxi-hosts-might-experience-read-or-w.html

What is TCP Delayed ACK?

Normally, when a host receives a TCP segment, it must send an ACK to confirm receipt.

But sending an ACK for every single segment would cause a lot of small packets (extra overhead).

To reduce this, TCP uses Delayed Acknowledgment:

The receiver waits a short time (typically up to 200 ms, often 40 ms on modern systems).

If another packet arrives in that window, it can piggyback the ACK with outgoing data or acknowledge multiple packets at once.

If no packet arrives by the timer → it sends the ACK anyway.

How it Works

Example:

Sender → Receiver: [Segment 1000–1499]

Receiver waits (delayed ACK timer starts).

Sender → Receiver: [Segment 1500–1999]

Receiver can now ACK both at once: ACK=2000.

Instead of sending 2 ACKs, the receiver sends 1 ACK → fewer packets on the wire.

Rules (RFC 1122, RFC 2581)

A host must not delay an ACK for more than 500 ms (most stacks use ≤200 ms).

ACK should be sent for every second full-sized segment (or sooner if app data to send back).

If only one small segment arrives and no more come, an ACK is sent when the timer expires.

Benefits

Reduces ACK traffic (fewer small packets).

Improves efficiency in bidirectional traffic (ACK piggybacked on data going back).

Downsides

Can add latency in some cases:

Small request/response protocols (e.g., Telnet, RPC).

If sender uses Nagle’s Algorithm (which waits for ACKs before sending more), delayed ACK + Nagle can interact badly → known as the “Nagle + Delayed ACK problem”.

In low-latency or real-time applications, delayed ACK can be undesirable.

In Wireshark

You’ll see:

[TCP ACKed segment delayed] (annotation).

Gaps in ACK timing (e.g., ACK only after 2 segments or ~40ms wait).

Summary

TCP Delayed ACK = receiver intentionally waits before sending ACK, to reduce ACK traffic.

Timer usually 40–200 ms.

ACKs can cover multiple segments.

Great for efficiency, but can cause small-latency issues.