From György Szaniszló:

Introduced a new tcp state variable: maxseqtobeacked, this is the
maximum seq number that can be acked by the rev party in normal case.
This new state variable only serves the proper detection of
tcp.analysis.ack_lost_segment indicator, and decouples it from the detection of
tcp.analysis.lost_segment indicator.

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6081

svn path=/trunk/; revision=37922

2 files changed, 17 insertions, 5 deletions

diff --git a/epan/dissectors/packet-tcp.c b/epan/dissectors/packet-tcp.c
index 0d920a3a0b..d39a7f6cb3 100644
--- a/epan/dissectors/packet-tcp.c
+++ b/epan/dissectors/packet-tcp.c
@@ -927,25 +927,25 @@ finished_fwd:
 
 
     /* ACKED LOST PACKET
-     * If this segment acks beyond the nextseqnum in the other direction
+     * If this segment acks beyond the 'max seq to be acked' in the other direction
      * then that means we have missed packets going in the
      * other direction
      *
      * We only check this if we have actually seen some seq numbers
      * in the other direction.
      */
-    if( tcpd->rev->nextseq
-    &&  GT_SEQ(ack, tcpd->rev->nextseq )
+    if( tcpd->rev->maxseqtobeacked
+    &&  GT_SEQ(ack, tcpd->rev->maxseqtobeacked )
     &&  (flags&(TH_ACK))!=0 ){
 /*QQQ tested*/
         if(!tcpd->ta){
             tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE, tcpd);
         }
         tcpd->ta->flags|=TCP_A_ACK_LOST_PACKET;
-        /* update nextseq in the other direction so we dont get
+        /* update 'max seq to be acked' in the other direction so we dont get
          * this indication again.
          */
-        tcpd->rev->nextseq=ack;
+        tcpd->rev->maxseqtobeacked=tcpd->rev->nextseq;
     }
 
 
@@ -1043,6 +1043,15 @@ finished_checking_retransmission_type:
         }
     }
 
+    /* Store the highest continuous seq number seen so far for 'max seq to be acked',
+     so we can detect TCP_A_ACK_LOST_PACKET contition
+     */
+    if(EQ_SEQ(seq, tcpd->fwd->maxseqtobeacked) || !tcpd->fwd->maxseqtobeacked) {
+        if( !tcpd->ta || !(tcpd->ta->flags&TCP_A_ZERO_WINDOW_PROBE) ){
+            tcpd->fwd->maxseqtobeacked=tcpd->fwd->nextseq;
+        }
+    }
+
 
     /* remember what the ack/window is so we can track window updates and retransmissions */
     tcpd->fwd->window=window;
diff --git a/epan/dissectors/packet-tcp.h b/epan/dissectors/packet-tcp.h
index e9bd011766..3716c41bc3 100644
--- a/epan/dissectors/packet-tcp.h
+++ b/epan/dissectors/packet-tcp.h
@@ -146,6 +146,9 @@ typedef struct _tcp_flow_t {
 	guint32 lastnondupack;	/* frame number of last seen non dupack */
 	guint32 dupacknum;		/* dupack number */
 	guint32 nextseq;		/* highest seen nextseq */
+	guint32 maxseqtobeacked;		/* highest seen continuous seq number (without hole in the stream) from the fwd party,
+									this is the maximum seq number that can be acked by the rev party in normal case.
+									If the rev party sends an ACK beyond this seq number it indicates TCP_A_ACK_LOST_PACKET contition */
 	guint32 nextseqframe;	/* frame number for segment with highest
 							 * sequence number
 							 */