Revision history [back]

Packet capture running on a mirrored switchport, capturing all traffic on all VLAN in both directions. Packet capture shows a lot of TCP Dup ACK's. Could the packet capture being set up to capture traffic in both directions be causing this?

74079 24.614726 10.xx.xx.xx 10.xx.xx.xx TCP 78 [TCP Dup ACK 74061#4] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=161267 74080 24.614727 10.xx.xx.xx 10.xx.xx.xx TCP 78 [TCP Dup ACK 74061#5] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=161267 74081 24.614727 10.xx.xx.xx 10.xx.xx.xx TCP 78 [TCP Dup ACK 74061#6] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=162715 74082 24.614728 10.xx.xx.xx 10.xx.xx.xx TCP 78 [TCP Dup ACK 74061#7] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=162715

Thanks

Packet capture running on a mirrored switchport, capturing all traffic on all VLAN in both directions. Packet capture shows a lot of TCP Dup ACK's. Could the packet capture being set up to capture traffic in both directions be causing this?

74079   24.614726   10.xx.xx.xx 10.xx.xx.xx TCP 78  [TCP Dup ACK 74061#4] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=161267
74080   24.614727   10.xx.xx.xx 10.xx.xx.xx TCP 78  [TCP Dup ACK 74061#5] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=161267
74081   24.614727   10.xx.xx.xx 10.xx.xx.xx TCP 78  [TCP Dup ACK 74061#6] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=162715
74082   24.614728   10.xx.xx.xx 10.xx.xx.xx TCP 78  [TCP Dup ACK 74061#7] 42900 → 80 [ACK] Seq=151 Ack=155475 Win=79680 Len=0 TSval=283933383 TSecr=1104610497 SLE=156923 SRE=162715
SRE=162715