During one of my experimental studies I noticed a pattern in TCP ACK’s frequency.
ACK segments are sent after receiving every 2 TCP segment. I kept asking why not 3 or 1 but 2. Then I found the answer in RFC1122 “Requirements for Internet Hosts — Communication Layers” when I was trying to find some information about delayed ACK concept. I am also quoting the related section. If you have also asked yourself, this is possibly the reason behind this pattern!
A host that is receiving a stream of TCP data segments can
increase efficiency in both the Internet and the hosts by
sending fewer than one ACK (acknowledgment) segment per data
segment received; this is known as a "delayed ACK" [TCP:5].
A TCP SHOULD implement a delayed ACK, but an ACK should not
be excessively delayed; in particular, the delay MUST be
less than 0.5 seconds, and in a stream of full-sized
segments there SHOULD be an ACK for at least every second
A delayed ACK gives the application an opportunity to update
the window and perhaps to send an immediate response.