I have taken some transaction captures using WireShark.

I have 3 servers, 1 web server connecting to an app server (locally) and then the same web server connecting to a remote app server... the captures I have taken; some use the route of web server to app server (locally), and another transaction would use web server to app server (remotely).

Basically I am getting TCP retransmission errors both ways (remote and local), or duplicate frames being sent on a very severe basis within my captures.

I know what they are and I know its typically due to network congestion. But how can I find out WHY??


Just as a comment, sometimes what appear to be duplicate frames can be caused by network adapter drivers getting mixed up with capture drivers.

If you see a clear pattern of TCP retransmission backing off, that is, a retransmit at 1 second, then 2, then 5, it's likely an actual problem with retransmissions, rather than a capture artifact.

To troubleshoot retransmission problems for real, within a local subnet that you control and are sure isn't just saturated with traffic, replace or adjust:

  • NIC drivers - try lower-end drivers, disable whizbang features, un-team, un-complicate
  • NICs
  • Switches
  • cables

If one of the boxes is more likely to be involved in a retransmission than the others, you can infer which link this might be from that.

| improve this answer | |

When you say that you're getting duplicate frames do you mean duplicate Acknowledgements or are you referring to the TCP Retransmits themselves or are they actually duplicate frames? A duplicate frame would most likely be the result of a bad NIC or driver while duplicate ACK's and TCP Retransmits are more likely the result of network congestion.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.