Thanks! I confirmed that the sequence numbers reported in the SACK are
indeed relative to the ISN. I guess this points to a bug in the
server's TCP stack. That'll be fun trying to track down ;-)

Medgya

Barry Margolin wrote:
> One thing to check -- are both the ACK and SACK values relative to the
> ISN? I think either tcpdump or Ethereal has a bug where SACKs are
> displayed as absolute values even when displaying relative sequence
> numbers and ACKs.