TCP Dup Ack sent 5usecs after the normal ACK

[kr9]

Hi Experts

I am pretty familiar with the way TCP should operate however I am a bit baffled by a recent capture of a tcp connection. The trace was taken over the period of 36 mins (running snoop at the client) and during that time the client made 5300 dup acks. The weird thing is that all these dup acks came between 4 and 6 microsecs after sending out the previous acknowledgement! No packets in between and definitely not enough time for any TCP timers to expire. It is not a harware dup as the sequence number in the dup ack is incremented by the correct number of data bytes sent in the previous packet. The Dup Acks all have a payload of zero. Is that a clue?

At first I though it was due to an old stack as the Sol 10 machine hadn't been patched in years. So I patched it to almost the latest release and the problem remained. I also get the problem on a Linux setup so I can't suspect the OS.

The attached small dump file shows 4 of the dup acks. Be grateful if anyone could put me out of my misery...

http://www.mediafire.com/file/uzhzvnngnmw/c7_sol10_updated.dmp