Why am I getting TCP retransmission errors?

Question

I have taken some transaction captures using WireShark.

I have 3 servers, 1 web server connecting to an app server (locally) and then the same web server connecting to a remote app server... the captures I have taken; some use the route of web server to app server (locally), and another transaction would use web server to app server (remotely).

Basically I am getting TCP retransmission errors both ways (remote and local), or duplicate frames being sent on a very severe basis within my captures.

I know what they are and I know its typically due to network congestion. But how can I find out WHY??

Answer 1

When you say that you're getting duplicate frames do you mean duplicate Acknowledgements or are you referring to the TCP Retransmits themselves or are they actually duplicate frames? A duplicate frame would most likely be the result of a bad NIC or driver while duplicate ACK's and TCP Retransmits are more likely the result of network congestion.

Answer 2

Just as a comment, sometimes what appear to be duplicate frames can be caused by network adapter drivers getting mixed up with capture drivers.

If you see a clear pattern of TCP retransmission backing off, that is, a retransmit at 1 second, then 2, then 5, it's likely an actual problem with retransmissions, rather than a capture artifact.

To troubleshoot retransmission problems for real, within a local subnet that you control and are sure isn't just saturated with traffic, replace or adjust:

• NIC drivers - try lower-end drivers, disable whizbang features, un-team, un-complicate
• NICs
• Switches
• cables

If one of the boxes is more likely to be involved in a retransmission than the others, you can infer which link this might be from that.