How is a SACK not containing two addresses interpreted A TCP header can contain the SACK option, which allows selective acknowledgement. As I've seen it in the wild, the SACK option usually contains two sequence numbers, lets say 0x00004000 and 0x00006000, and then this segments sequence number is e.g. 0x00002000, which means: I have everything up to 0x00002000, and I also have everything between 0x00004000 to 0x00006000, so start sending with 0x00002001. On wikipedia I read that the SACK option can also contain 1, 3, or 4 addresses. What do they mean?

Okay, I just discovered the answer myself: the option contains between 1 and 4 spans of addresses.

Which means a SACK option with a length of 10 doesn't contain "one address", but "one address range", because a sequence number of course is just 4 bytes (+1 byte for type option, +1 byte for length of option), duh.