Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not)

It must be some kind of packet loss, because from other clients there are no problems. It is just happening from one client to the remote server.

Usually, i messure packet loss with ping, but the remote server is blocking ICMP.

I made a binary TCPDUMP file. How can i see if there is packet loss?


capturing was done on the client. we do not have ssh access to the remote server.

share|improve this question
1  
Where is the tcpdump capture made from - the remote server, or the local machine? –  Andy Smith Dec 1 '11 at 11:44
add comment

2 Answers

up vote 6 down vote accepted

You can measure packet retransmits from the client to the server by counting the number of duplicate sequence numbers.

Packet retransmits from the server to the client can be measured by counting duplicate Ack numbers.

Note that a retransmit is triggered by more than just total loss (= timeout); if the remote machine rejects the packet, or the packet is corrupted, the local machine must also retransmit.

share|improve this answer
    
thank you so much :-) –  JMW Dec 1 '11 at 12:58
    
Isn't it also the case that a client may re-use the same SEQ when acknowledging receipt of windowed data? In this case, the SEQ stays the same and the ACK increments until the window is completed. So perhaps it is better to look for tcp.analysis.retransmission as @quanta suggests. –  chrishiestand Feb 19 at 0:49
add comment

tshark can filter retransmission, duplicate ACK, lost segment, ...

$ tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack",\
"COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment",\
"COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission"

Here's a sample result:

IO Statistics
Interval: 1.000 secs
Column #0: COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission
Column #1: COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack
Column #2: COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment
Column #3: COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission
                |   Column #0    |   Column #1    |   Column #2    |   Column #3    
Time            |          COUNT |          COUNT |          COUNT |          COUNT 
000.000-001.000                 0                0                0                0 
001.000-002.000                 0                0                0                0 
002.000-003.000                 0                0                0                0 
003.000-004.000                 0                0                0                0 
004.000-005.000                 0                0                0                0 
005.000-006.000                 0                0                0                0 
006.000-007.000                 1                2                1                0 
007.000-008.000                 3                1                0                0 
008.000-009.000                 0                0                0                0 
009.000-010.000                 1                0                1                0 
010.000-011.000                 0                0                0                0 
011.000-012.000                 0                0                0                0 
012.000-013.000                 0                0                0                0 
013.000-014.000                 1                0                0                0 
====================================================================================
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.