Revision history  [back]

I assume from the IMG that you are capturing on or near the server.

The traversal of network packets over the network takes time. So while the client receives TCP segments and ACKs them, there are already new packets underway from the server. This means the ACKs you are seeing are ACKing packets earlier in the trace. You can see that with the SEQ numbers in the image. This first packet from the server has SEQ number 41099. All the ACK in the image are acking TCP segment before that first visible segment.

If you capture on the client side, you would see a different pattern. And it is more clear how the client ACKs the incoming TCP segments.