This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

lot of TCP DUP & Retransmission

0

I see a lot of DUP ACKS and re transmission & fast re-transmissions. Can this be a reason of slow transfer rate over the wan links ?alt text

asked 14 Jul '14, 08:54

Rikki's gravatar image

Rikki
16336
accept rate: 0%

https://www.cloudshark.org/captures/ef3bb6cb4701

here is the upload of the capture

(14 Jul '14, 09:38) Rikki

That capture file does not match the screenshot. Any reason for that?

(15 Jul '14, 03:58) Kurt Knochner ♦

One Answer:

0

Looks like classic packet loss with a latency that leads to multiple DUP ACKs to be sent for each of the missing packets. So without looking too deeply into the packets I'd say you have packet loss, leading to retransmissions (which take a while) and this results in slow transfer rates.

answered 15 Jul '14, 00:39

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

thanks, The link has no packet loss as this is a very critical link and no latency or packet loss is affordable to us. I am taking this capture at receiver end & RTT from source to destination is 130ms, probably that is the reason why we see so many DUP ACKs being sent before fast re transmitted packet arrives. Can there be any other reason.

(15 Jul '14, 03:39) Rikki

Still, looks like the packet #119 in your trace is a true retranmission (not an out-of-order), which means it is quite certain that there has been packet loss.

I can't tell where or why this happened, as that would require to have two simultaneous traces taken at both ends of the conversation.

By the way, it is next to impossible to simply declare a line "not having packet loss", because with standard Ethernet packet loss is always possible.

(15 Jul '14, 03:47) Jasper ♦♦

and no latency or packet loss is affordable to us.

hm.. that link seems to have quite some latency ;-))

(15 Jul '14, 03:54) Kurt Knochner ♦

I am taking a capture on the source side as well to see if we get same
re transmissions or multiple DUP ACKs

(15 Jul '14, 04:18) Rikki

You were right, there are about 1-5% packet drops in the link but they are for very short interval & highly intermittent & our monitoring tools did not detect that. Thanks...

(16 Jul '14, 04:25) Rikki