Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have taken some transaction captures using WireShark.

I have 3 servers, 1 web server connecting to an app server (locally) and then the same web server connecting to a remote app server... the captures I have taken; some use the route of web server to app server (locally), and another transaction would use web server to app server (remotely).

Basically I am getting TCP retransmission errors both ways (remote and local), or duplicate frames being sent on a very severe basis within my captures.

I know what they are and I know its typically due to network congestion. But how can I find out WHY??

share|improve this question

2 Answers 2

Just as a comment, sometimes what appear to be duplicate frames can be caused by network adapter drivers getting mixed up with capture drivers.

If you see a clear pattern of TCP retransmission backing off, that is, a retransmit at 1 second, then 2, then 5, it's likely an actual problem with retransmissions, rather than a capture artifact.

To troubleshoot retransmission problems for real, within a local subnet that you control and are sure isn't just saturated with traffic, replace or adjust:

  • NIC drivers - try lower-end drivers, disable whizbang features, un-team, un-complicate
  • NICs
  • Switches
  • cables

If one of the boxes is more likely to be involved in a retransmission than the others, you can infer which link this might be from that.

share|improve this answer

When you say that you're getting duplicate frames do you mean duplicate Acknowledgements or are you referring to the TCP Retransmits themselves or are they actually duplicate frames? A duplicate frame would most likely be the result of a bad NIC or driver while duplicate ACK's and TCP Retransmits are more likely the result of network congestion.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.