4

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not)

It must be some kind of packet loss, because from other clients there are no problems. It is just happening from one client to the remote server.

Usually, i messure packet loss with ping, but the remote server is blocking ICMP.

I made a binary TCPDUMP file. How can i see if there is packet loss?


capturing was done on the client. we do not have ssh access to the remote server.

1
  • 1
    Where is the tcpdump capture made from - the remote server, or the local machine?
    – Andy Smith
    Dec 1, 2011 at 11:44

2 Answers 2

9

You can measure packet retransmits from the client to the server by counting the number of duplicate sequence numbers.

Packet retransmits from the server to the client can be measured by counting duplicate Ack numbers.

Note that a retransmit is triggered by more than just total loss (= timeout); if the remote machine rejects the packet, or the packet is corrupted, the local machine must also retransmit.

1
  • Isn't it also the case that a client may re-use the same SEQ when acknowledging receipt of windowed data? In this case, the SEQ stays the same and the ACK increments until the window is completed. So perhaps it is better to look for tcp.analysis.retransmission as @quanta suggests. Feb 19, 2014 at 0:49
15

tshark can filter retransmission, duplicate ACK, lost segment, ...

$ tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack",\
"COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment",\
"COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission"

Here's a sample result:

IO Statistics
Interval: 1.000 secs
Column #0: COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission
Column #1: COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack
Column #2: COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment
Column #3: COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission
                |   Column #0    |   Column #1    |   Column #2    |   Column #3    
Time            |          COUNT |          COUNT |          COUNT |          COUNT 
000.000-001.000                 0                0                0                0 
001.000-002.000                 0                0                0                0 
002.000-003.000                 0                0                0                0 
003.000-004.000                 0                0                0                0 
004.000-005.000                 0                0                0                0 
005.000-006.000                 0                0                0                0 
006.000-007.000                 1                2                1                0 
007.000-008.000                 3                1                0                0 
008.000-009.000                 0                0                0                0 
009.000-010.000                 1                0                1                0 
010.000-011.000                 0                0                0                0 
011.000-012.000                 0                0                0                0 
012.000-013.000                 0                0                0                0 
013.000-014.000                 1                0                0                0 
====================================================================================

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .