TCP SACK Detect

What is TCP SACK?

SACK = Selective Acknowledgment (RFC 2018).

In normal TCP without SACK:

If a packet is lost, the receiver can only say “I got everything up to N”.

Sender must retransmit all subsequent packets, even if only one was lost.

With SACK enabled:

Receiver tells sender exactly which blocks of data were received successfully (e.g., “I have bytes 1000–2000 and 3000–4000, but I’m missing 2000–3000”).

This lets the sender retransmit only the missing segment(s) instead of retransmitting everything.

Does the server need to send duplicate ACKs to request retransmission?

Yes — that’s how the sender is normally triggered:

If a segment is missing, the receiver continues to ACK the last contiguous byte it received → this produces duplicate ACKs (ACK with the same number).

After 3 duplicate ACKs, the sender assumes packet loss (fast retransmit).

With SACK enabled, those duplicate ACKs carry SACK information telling the sender which pieces are missing.

So:

Duplicate ACKs are still used, but with SACK they carry extra info.

Example:

1. Without SACK

Client Server

| |

| <---- [1000–1999] ------------------- |

| -------- ACK=2000 ------------------> |

| |

| <---- [2000–2999] (lost) ------------X|

| |

| <---- [3000–3999] ------------------- |

| -------- ACK=2000 (dup#1) ----------> |

| <---- [4000–4999] ------------------- |

| -------- ACK=2000 (dup#2) ----------> |

| <---- [5000–5999] ------------------- |

| -------- ACK=2000 (dup#3) ----------> |

| |

| <---- [2000–2999] (retransmit) ------ |

| -------- ACK=6000 ------------------> |

| |

Observation: Client keeps sending the same ACK=2000, which doesn’t tell the server what else it already has. Server retransmits after 3 duplicate ACKs.

2. With SACK

Client Server

| |

| <---- [1000–1999] ------------------- |

| -------- ACK=2000 ------------------> |

| |

| <---- [2000–2999] (lost) ------------X|

| |

| <---- [3000–3999] ------------------- |

| -- ACK=2000, SACK=3000–4000 --------> |

| <---- [4000–4999] ------------------- |

| -- ACK=2000, SACK=3000–5000 --------> |

| <---- [5000–5999] ------------------- |

| -- ACK=2000, SACK=3000–6000 --------> |

| |

| <---- [2000–2999] (retransmit only) - |

| -------- ACK=6000 ------------------> |

| |

Observation: With SACK, duplicate ACKs still happen, but they carry extra SACK info showing exactly which blocks arrived. Server retransmits only the missing piece.

This is why SACK makes TCP recovery faster and more bandwidth-efficient.