Ask Your Question

Can you help analyse these TCP retransmit , and DUP Acks .

asked 2020-05-09 03:25:28 +0000

sharky483 gravatar image

Can you help me understand these TCP retransmit , and DUP Acks

edit retag flag offensive close merge delete


Is it possible to share the files to public without a login to view them?

Chuckc gravatar imageChuckc ( 2020-05-09 05:51:47 +0000 )edit

@bubbasnmp.. Done

sharky483 gravatar imagesharky483 ( 2020-05-09 14:01:40 +0000 )edit

Looks like the capture system is doing TCP offload and passing large packets up.

smallsmtp - frame #17
largesmtp - frame #19

Can you make the capture on another system in the middle that would see the individual packets?
That would make it easier to diagnose.

Chuckc gravatar imageChuckc ( 2020-05-09 14:58:17 +0000 )edit

@bubbasnmp , sure i will get the captures from something in the middle .

Just to clarify , the Data fragment byte size is what makes u think , the machine is doing TCP offload ?

sharky483 gravatar imagesharky483 ( 2020-05-11 13:28:51 +0000 )edit

Look a little lower in the stack at the ip.len which is very large.
If you can experiment on the capture machine, it might be possible to disable offload for testing.

Chuckc gravatar imageChuckc ( 2020-05-11 14:39:44 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-05-10 10:57:54 +0000

JasMan gravatar image

updated 2020-05-10 11:00:50 +0000

The retransmits are triggered by the DupACKs. The client thinks the server is missing a packet.

The DupACKs are comming from a third system. The first ACKs from are comming from a system with a TTL of 123 (probably 5 hops away). The DupACKs are comming from a system with a TTL of 254 (higher TTL than the first system and probably only 2 hops away).

Loadbalancer? Firewall?

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-05-09 03:25:28 +0000

Seen: 219 times

Last updated: May 10 '20