Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How can I find out if I have too many TCP Retransmissions

I am seeing a lot of TCP Retransmissions in my capture. How do I determine if I am getting too many?

It will not let me upload the image.

[TCP Retransmission] [TCP Port numbers reused] 65040 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

Echo (ping) request id=0x0001, seq=9897/43302, ttl=128 (reply in 1589) Echo (ping) reply id=0x0001, seq=9897/43302, ttl=64 (request in 1588) 995 > 65040 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Keep-Alive] 443 > 64991 [ACK] Seq=0 Ack=125 Win=29216 Len=0 [TCP Keep-Alive ACK] 64991 > 443 [ACK] Seq=125 Ack=1 Win=262656 Len=0 [TCP Retransmission] 80 > 64431 [FIN, ACK] Seq=1 Ack=2 Win=501 Len=0 [TCP ZeroWindow] 64431 > 80 [ACK] Seq=2 Ack=2 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65042 > 465 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

465 > 65042 [RST, ACK] Seq=1 Ack=1 Win=5840 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65029 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

993 > 65029 [RST, ACK] Seq=1 Ack=1 Win=48 Len=0 [TCP Keep-Alive] 443 > 64946 [ACK] Seq=0 Ack=125 Win=29216 Len=0 [TCP Keep-Alive ACK] 64946 > 443 [ACK] Seq=125 Ack=1 Win=2097920 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65047 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

993 > 65047 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65049 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

[TCP Retransmission] [TCP Port numbers reused] 65050 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

[TCP Retransmission] [TCP Port numbers reused] 65048 > 465 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

995 > 65049 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 993 > 65050 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65036 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

[TCP Retransmission] [TCP Port numbers reused] 65034 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

[TCP Retransmission] [TCP Port numbers reused] 65035 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

995 > 65036 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 995 > 65035 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 993 > 65034 [RST, ACK] Seq=1 Ack=1 Win=48 Len=0 465 > 65048 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65054 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

[TCP Retransmission] [TCP Port numbers reused] 65038 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

993 > 65054 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 995 > 65038 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65040 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

995 > 65040 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65042 > 465 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

465 > 65042 [RST, ACK] Seq=1 Ack=1 Win=5840 Len=0

How can I find out if I have too many TCP Retransmissions

I am seeing a lot of TCP Retransmissions in my capture. How do I determine if I am getting too many?

It will not let me upload the image.

[TCP Retransmission] [TCP Port numbers reused] 65040  >  995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 Echo (ping) request id=0x0001, seq=9897/43302, ttl=128 (reply in 1589) Echo (ping) reply id=0x0001, seq=9897/43302, ttl=64 (request in 1588) 995 > 65040 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Keep-Alive] 443 > 64991 [ACK] Seq=0 Ack=125 Win=29216 Len=0 [TCP Keep-Alive ACK] 64991 > 443 [ACK] Seq=125 Ack=1 Win=262656 Len=0 [TCP Retransmission] 80 > 64431 [FIN, ACK] Seq=1 Ack=2 Win=501 Len=0 [TCP ZeroWindow] 64431 > 80 [ACK] Seq=2 Ack=2 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65042 > 465 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 465 > 65042 [RST, ACK] Seq=1 Ack=1 Win=5840 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65029 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 993 > 65029 [RST, ACK] Seq=1 Ack=1 Win=48 Len=0 [TCP Keep-Alive] 443 > 64946 [ACK] Seq=0 Ack=125 Win=29216 Len=0 [TCP Keep-Alive ACK] 64946 > 443 [ACK] Seq=125 Ack=1 Win=2097920 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65047 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 993 > 65047 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65049 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 [TCP Retransmission] [TCP Port numbers reused] 65050 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 [TCP Retransmission] [TCP Port numbers reused] 65048 > 465 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 995 > 65049 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 993 > 65050 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65036 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 [TCP Retransmission] [TCP Port numbers reused] 65034 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 [TCP Retransmission] [TCP Port numbers reused] 65035 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 995 > 65036 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 995 > 65035 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 993 > 65034 [RST, ACK] Seq=1 Ack=1 Win=48 Len=0 465 > 65048 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65054 > 993 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 [TCP Retransmission] [TCP Port numbers reused] 65038 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 993 > 65054 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 995 > 65038 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65040 > 995 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 995 > 65040 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 [TCP Retransmission] [TCP Port numbers reused] 65042 > 465 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=4 SACK_PERM=1

SACK_PERM=1 465 > 65042 [RST, ACK] Seq=1 Ack=1 Win=5840 Len=0

Len=0