TCP: do not mark data following a ZeroWindowProbe as retransmission

The single byte within the ZWP could be retransmitted with the next
segment, this is perfectly acceptable behavior. Do not flag these new
segments as retransmissions or Out-Of-Order.

Bug: 15427
Change-Id: I76db2b7a2b684c8c78fa24c9c4b457e1833d12b7
Reviewed-on: https://code.wireshark.org/review/31731
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Jasper Bongertz <jasper@packet-foo.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>

docbook/wsug_src/WSUG_chapter_advanced.asciidoc

@@ -531,6 +531,14 @@ Set when the sequence number is equal to the next expected sequence
 number, the segment size is one, and last-seen window size in the
 reverse direction was zero.
 
+If the single data byte from a Zero Window Probe is dropped by the receiver (not
+ACKed), then a subsequent segment should not be flagged as retransmission if all
+of the following conditions are true for that segment:
+- The segment size is larger than one.
+- The next expected sequence number is one less than the current sequence number.
+
+This affects “Fast Retransmission”, “Out-Of-Order”, or “Retransmission”.
+
 // TCP_A_ZERO_WINDOW_PROBE_ACK
 [float]
 ==== TCP ZeroWindowProbeAck

epan/dissectors/packet-tcp.c

@@ -2112,6 +2112,17 @@ finished_fwd:
             goto finished_checking_retransmission_type;
         }
 
+        /* This segment is *not* considered a retransmission/out-of-order if
+         *  the segment length is larger than one (it really adds new data)
+         *  the sequence number is one less than the previous nextseq and
+         *      (the previous segment is possibly a zero window probe)
+         *
+         * We should still try to flag Spurious Retransmissions though.
+         */
+        if (seglen > 1 && tcpd->fwd->tcp_analyze_seq_info->nextseq - 1 == seq) {
+            seq_not_advanced = FALSE;
+        }
+
         /* If there were >=2 duplicate ACKs in the reverse direction
          * (there might be duplicate acks missing from the trace)
          * and if this sequence number matches those ACKs