TCP streams/connections

If you are referring to the Wireshark "data length" column, that is a SUM of all IP fragments of one TCP segment.

The reason why this is done is that your OS is actually sending big TCP segments to the network card and the network card does the fragmentation to the (smaller) MTU, that's why you see that you're sending 2776 bytes long frames (the same can happen on the receiving side I think). If you'd sniff directly on the wire (a switch for example) you would see only 1518/1522 bytes frames.

This is called Large Segment Offload and is a function of a network card. It can be turned off and then the OS will have to send frames to the network card which are under the MTU limit.

I teach TCP, and I often run into people who were mis-taught that the ACK is only sent when the Window Size is reached. This is not true. (To be really transparent, I too taught this incorrectly before I knew better as well, so I completely understand the mistake).

NOTE, I'll be using Receiver/Sender to describe it, but keep in mind TCP is bidirectional, and both parties maintain a Window Size.

The Window Size (that the Receiver sets) is a hard limit on how many bytes the Sender can send without being forced to stop to wait for an acknowledgement.

The Window Size does not determine how often the Receiver should be sending ACKnowledgements. Originally, the TCP protocol called for an acknowledgement to be sent after each segment was received. Later, TCP was optimized to allow the Receiver to skip ACKs and send an ACKnowledgment every other packet (or more).

The goal of TCP then, is for the Sender to continually be sending packets, without delay or interruption, because it continually receives ACKnowledgements, such that the count of "bytes in transit" is always less than the Window Size. If at any time, the Sender has sent a count of bytes equal to the window size without receiving an ACK, it is forced to pause sending and wait.

The important thing to consider in all this is the Round Trip Time. Often, when you are studying TCP in a wireshark, you are only seeing the perspective of one party in the TCP conversation, which makes it hard to infer, or truly "see", the effect of the RTT. To illustrate the effect of RTT, take a look at these two captures. They are both capturing the same conversation, a 2MB file download over HTTP, but one is from the perspective of the Client, and the other is from the perspective of the Server.

Note: its easier to analyse TCP if you turn off the Wireshark feature "Allow subdissector to reassemble TCP streams"

Notice from the Server side capture (who is the sender of the file), the Server sends 8 full sized packets in a row (packet#'s 6-13) before receiving the first ACK in packet# 14. If you drill down in that ACK, notice the Client's acknowledgement is for the segment sent in Packet#7. And the ACK the Client sent in packet 20 is from the segment sent in Packet#9.

See how the Client is indeed acknowledging every other packet. But it almost seems like it is acknowledging them "late". But in fact, this is just the effect of Round Trip Time. The Sender is able to send 7~ segments in the time it takes for the first segment to reach client and for the client's ACK to reach the server. If you take a look at the capture from the Client's perspective, it looks very 'clean', which is to say that every second packet it receives, it sends out an ACK.

Notice also what happens at Packet# 23. The Server has sent all it can, because the "bytes in transit" reaches the Window Size, so it is forced to stop sending. Until the next ACK arrives. Since the ACK's are coming in every other segment received. Each ACK allows the sender to again send two new segments, before the Window is full again, and the Server is again forced to pause. This happens up until Packet# 51, when the Client (Recever) increases the Window Size significantly, allowing the Server (sender) to start transmitting data uninhibited again... at least until Packet #175, when the new Window fills up.