Can you help me understand these TCP retransmit , and DUP Acks
https://www.cloudshark.org/captures/c... https://www.cloudshark.org/captures/b...
The retransmits are triggered by the DupACKs. The client thinks the server is missing a packet.
The DupACKs are comming from a third system. The first ACKs from 192.168.4.149 are comming from a system with a TTL of 123 (probably 5 hops away). The DupACKs are comming from a system with a TTL of 254 (higher TTL than the first system and probably only 2 hops away).
Loadbalancer? Firewall?
Asked: 2020-05-09 03:25:28 +0000
Seen: 258 times
Last updated: May 10 '20
Is it possible to share the files to public without a login to view them?
@bubbasnmp.. Done
Looks like the capture system is doing TCP offload and passing large packets up.
Can you make the capture on another system in the middle that would see the individual packets?
That would make it easier to diagnose.
@bubbasnmp , sure i will get the captures from something in the middle .
Just to clarify , the Data fragment byte size is what makes u think , the machine is doing TCP offload ?
Look a little lower in the stack at the
ip.lenwhich is very large.If you can experiment on the capture machine, it might be possible to disable offload for testing.