Ask Your Question

Revision history [back]

Hi Andrew,

I opened the PCAP and took a look at TCP conversations and sorted by the number of packets.

You mentioned the ISP link being checked so I looked for a public IP with lots of traffic to or from

I saw that host is sending a lot of traffic to host (a public IP) so I focused on this stream.

Use this filter to see the stream eq 13

I don't see a lot of malformed HTTP: 90 overall and none for this stream.

"Expert Information" is a good place to look for issues but most items listed in red or yellow need to be investigated to make sure they are real issues.

Now I do see an odd behaviour on host where it sends _two copies_ of most (all?) segments.

This is why there are so many TCP Retransmission, TCP Dup ACK and TCP Out-of-Order

Take the first few packets:

Host sends a segment to host (frame 1855) and then the same segment (frame 1856) again after 0,01 ms. (That's 0.01 milliseconds!)

Host is even sending duplicate ACK to host See frame 1988 and then 1990 seen only 0.006 ms after.

Now this could be a real issue with the host or it could be an issue with your capture.

There is a possibility duplicate packets are caused by defective hardware.

Not sure how you took this capture but I would try to move the capture point "elsewhere" to see if the issue persists.

If it does then I would try to run the Livestream on another host.

Hope this helps.