Can Wireshark help determine cause of latency in remote-desktop connection?

Question

We have a small Remote Desktop farm using Windows Server 2008. We have a gateway and two servers. Most of our users have no issues, but we have two or three that get 1-2 second latency when typing. Graphics and screen updates work well, but typing is brutally slow.

They connect from one of our client's networks. I'm looking for the best way to determine and document what is causing the slowness so we can determine the next step.

I've done speedtests, tracert, and pings. The response times are all within the same range as users without issue.

We are thinking of putting wireshark on one of the machines, but I'm not sure what to look for in the results to demonstrate poor latency with typing.

Thanks for any thoughts or suggestions.

Answer 1

Wireshark could help, depending on what's the actual cause of the problem. The caveat being that Wireshark is only going to show you one side of the conversation (unless you run Wireshark simultaneously on the client and the server) and can't show you anything that's happening in between the source and destination. I would run Wireshark on one of the affected clients and key on these things:

A high volume of broadcast traffic (at either the physical or network layer or both), which is an indication that there's congestion and is likely causing the following symptoms:

A high volume of duplicate ACK's

A high volume of TCP retransmits or fast retransmits

While broadcast traffic, duplcate ACK's and TCP retransmits are a normal part of network communication on any network, a large volume of them is an indication of a problem. If running Wireshark on the client doesn't yield any results then you'll need to move Wireshark closer to the destination (server) one hop at a time (where possible) until you're able to see something in the capture that gives you an idea of what's happening.

Another tool you can use is Colasoft Capsa (they have a free edition) which has a much easier to intepret interface and has several different ways to "visualize" the capture, making it easier to "see" the problem.