title: Is it possible that packet captured by tcpdump, but lost in tcp kernel?
body: <pre><code>  1 10:59:11.303358 IP CCC &gt; SSS: S 2325818282:2325818282(0) win 14600 &lt;mss 1460,sackOK,timestamp 2358537033 0,nop,wscale 7&gt;
    2 10:59:11.304131 IP SSS &gt; CCC: S 3397574260:3397574260(0) ack 2325818283 win 14440 &lt;mss 1456,sackOK,timestamp 994572340 2358537033,nop,wscale 9&gt;
    3 10:59:11.305182 IP CCC &gt; SSS: . ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
    4 10:59:11.305280 IP CCC &gt; SSS: . 1:1445(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
    5 10:59:11.305288 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572342 2358537035&gt;
    6 10:59:11.305370 IP CCC &gt; SSS: . 1445:2889(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
    7 10:59:11.305418 IP CCC &gt; SSS: . 2889:4333(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
    8 10:59:11.305422 IP CCC &gt; SSS: . 4333:5777(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
    9 10:59:11.305434 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572343 2358537035,nop,nop,sack 1 {4333:5777}&gt;
   10 10:59:11.305426 IP CCC &gt; SSS: . 5777:7221(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
   11 10:59:11.305439 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572343 2358537035,nop,nop,sack 1 {4333:7221}&gt;
   12 10:59:11.305611 IP CCC &gt; SSS: P 7221:8665(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
   13 10:59:11.305632 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572343 2358537035,nop,nop,sack 1 {4333:8665}&gt;
   14 10:59:11.305617 IP CCC &gt; SSS: . 8665:10109(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
   15 10:59:11.305638 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572343 2358537035,nop,nop,sack 1 {4333:10109}&gt;
   16 10:59:11.305621 IP CCC &gt; SSS: . 10109:11553(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
   17 10:59:11.305643 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572343 2358537035,nop,nop,sack 1 {4333:11553}&gt;
   18 10:59:11.305624 IP CCC &gt; SSS: . 11553:12997(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537035 994572340&gt;
   19 10:59:11.305648 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572343 2358537035,nop,nop,sack 1 {4333:12997}&gt;
   20 10:59:11.306649 IP CCC &gt; SSS: . 12997:14441(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537036 994572342&gt;
   21 10:59:11.306652 IP CCC &gt; SSS: . 14441:15885(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537036 994572342&gt;
   22 10:59:11.306655 IP CCC &gt; SSS: . 15885:17329(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537036 994572342&gt;
   23 10:59:11.306722 IP CCC &gt; SSS: P 17329:18773(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537036 994572343&gt;
   24 10:59:11.306735 IP SSS &gt; CCC: . ack 1445 win 34 &lt;nop,nop,timestamp 994572344 2358537035,nop,nop,sack 2 {17329:18773}{4333:12997}&gt;
   25 10:59:11.306725 IP CCC &gt; SSS: . 1445:2889(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537036 994572343&gt;
   26 10:59:11.306743 IP SSS &gt; CCC: . ack 2889 win 40 &lt;nop,nop,timestamp 994572344 2358537036,nop,nop,sack 2 {17329:18773}{4333:12997}&gt;
   27 10:59:11.306731 IP CCC &gt; SSS: . 2889:4333(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537037 994572343&gt;
   28 10:59:11.306808 IP SSS &gt; CCC: . ack 12997 win 46 &lt;nop,nop,timestamp 994572344 2358537037,nop,nop,sack 1 {17329:18773}&gt;
   29 10:59:11.307932 IP CCC &gt; SSS: . 12997:14441(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537038 994572344&gt;
   30 10:59:11.307942 IP SSS &gt; CCC: . ack 14441 win 51 &lt;nop,nop,timestamp 994572345 2358537038,nop,nop,sack 1 {17329:18773}&gt;
   31 10:59:11.308121 IP CCC &gt; SSS: . 18773:20217(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537038 994572344&gt;
   32 10:59:11.308127 IP CCC &gt; SSS: . 20217:21661(1444) ack 1 win 115 &lt;nop,nop,timestamp 2358537038 994572344&gt;
  </code></pre>
  
  <p>From line 6,7,8 tcpdump catched data 1445~5777,
  but it still ack with 1445 in line 9.
  I suggest that kernel hasn't received that data in time.
  But just after line 25, it ack 2889, which make the packet in line 6 seem lost.
  So, where does the packet in line 6 go?</p>
  
  <p>I diff two file genated from 'netstat -s' before and after transmission.
  The result show that there are bad segments received. Is it the key to my problem?</p>
  
  <pre><code>&lt;     4637068 segments received
  &lt;     3972086 segments send out
  &lt;     118982 segments retransmited
  &lt;     40245 bad segments received.
  ---
  &gt;     4637506 segments received
  &gt;     3972383 segments send out
  &gt;     118989 segments retransmited
  &gt;     40402 bad segments received.
  29,30c29,30
  </code></pre>