Lots of TCP retransmission and TCP ACKed unseen segment Windows Server 2019
Hi everyone,
We are experiencing performance issues (slow access on websites) between Windows Server 2016 and 2019. On Windows Server 2016, everything is smooth and we have normal TCP packets between web server and database server (iBMI AS400).
632 14.100 192.168.158.20 192.168.158.24 TCP 60 8471 → 49706 [PSH, ACK] Seq=396128345 Ack=1570466466 Win=8192 Len=0
634 14.100 192.168.158.24 192.168.158.20 TCP 94 49706 → 8471 [PSH, ACK] Seq=1570466466 Ack=396128385 Win=8208 Len=40
633 14.100 192.168.158.20 192.168.158.24 TCP 94 8471 → 49706 [PSH, ACK] Seq=396128345 Ack=1570466466 Win=8192 Len=40
635 14.101 192.168.158.20 192.168.158.24 TCP 60 8471 → 49706 [PSH, ACK] Seq=396128385 Ack=1570466506 Win=8192 Len=0
On the contrary, on Windows Server 2019, web server response time are real slow and we have a lot of TCP Retransmission and TCP ACKed unseen segment packets :
8779 37.174 192.168.158.70 192.168.158.20 TCP 557 [TCP Retransmission] 49971 → 8471 [PSH, ACK] Seq=3932858070 Ack=2649144259 Win=8208 Len=503
8780 37.174 192.168.158.20 192.168.158.70 TCP 60 [TCP ACKed unseen segment] 8471 → 49971 [PSH, ACK] Seq=2649144259 Ack=3932858573 Win=8192 Len=0
8781 37.174 192.168.158.20 192.168.158.70 TCP 596 8471 → 49971 [PSH, ACK] Seq=2649144259 Ack=3932858573 Win=8192 Len=542
8782 37.175 192.168.158.70 192.168.158.20 TCP 180 49971 → 8471 [PSH, ACK] Seq=3932858573 Ack=2649144801 Win=8212 Len=126
8783 37.205 192.168.158.70 192.168.158.20 TCP 302 [TCP Retransmission] 49971 → 8471 [PSH, ACK] Seq=3932858573 Ack=2649144801 Win=8212 Len=248
8784 37.206 192.168.158.20 192.168.158.70 TCP 60 [TCP ACKed unseen segment] 8471 → 49971 [PSH, ACK] Seq=2649144801 Ack=3932858821 Win=8192 Len=0
Any clues about what can cause those problems ?
Thank you.
Best regards, Maxime.
Were the captures done on the servers or LAN? If this was on the servers, move your capture points to the LAN. The 2019 server capture shows that the frame 8783 is a TCP timeout retransmission of 8782. Frame 8784 is TCP ACK of 8783 (3932858573+248). What we don't know, is what happen with frame 8782 on the LAN and servers.
Thank you for your answer, the captures were done on the servers. But what i don't understand are the differences between Windows Server 2016 frames and Windows Server 2019. Both on same SAN, host and using same network switch.
I have noticed i have to capture from another server in the LAN and not from the 2019 one but is it normal that i have so many TCP retransmission and TCP ACKed unseen segment ? The capture just shows few messages, in 20 min i have hundreds or more of those packets.
Best regards