Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Identify reason for TCP retransmission

I am experiencing slow SCP transfers between servers.

Below is the packet capture from an intermediate switch in the traffic path.

Any guidance will be appreciated!

TCP retransmission is occurring at packet 26,36,38.

1   0.000000 10.10.10.16 → 10.10.20.17 TCP 82 0xf762 (63330) 51661 → 22 [SYN, ECE, CWR] Seq=0 Win=65535 Len=0 MSS=8960 WS=512 SACK_PERM TSval=433249404 TSecr=0
2   0.000000 10.10.10.16 → 10.10.20.17 TCP 74 0xf763 (63331) 51661 → 22 [ACK] Seq=1 Ack=1 Win=71168 Len=0 TSval=433249404 TSecr=3052563362
3   0.000000 10.10.10.16 → 10.10.20.17 SSH 95 0xf764 (63332) Client: Protocol (SSH-2.0-OpenSSH_9.8)
4   0.029006 10.10.10.16 → 10.10.20.17 SSHv2 1290 0xf766 (63334) Client: Key Exchange Init
5   0.031004 10.10.10.16 → 10.10.20.17 SSHv2 154 0xf767 (63335) Client: Diffie-Hellman Key Exchange Init
6   0.039000 10.10.10.16 → 10.10.20.17 SSHv2 186 0xf768 (63336) Client: New Keys, Encrypted packet (len=96)
7   0.146996 10.10.10.16 → 10.10.20.17 SSHv2 138 0xf76b (63339) Client: Encrypted packet (len=64)
8   0.148003 10.10.10.16 → 10.10.20.17 SSHv2 154 0xf76c (63340) Client: Encrypted packet (len=80)
9   0.163001 10.10.10.16 → 10.10.20.17 SSHv2 186 0xf76f (63343) Client: Encrypted packet (len=112)
10   0.274995 10.10.10.16 → 10.10.20.17 TCP 74 0xf78e (63374) 51661 → 22 [ACK] Seq=1686 Ack=1870 Win=71168 Len=0 TSval=433249432 TSecr=3052563378
11   4.509028 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe60 (65120) Client: Encrypted packet (len=96)
12   4.526026 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe62 (65122) Client: Encrypted packet (len=96)
13   4.529032 10.10.10.16 → 10.10.20.17 SSHv2 234 0xfe63 (65123) Client: Encrypted packet (len=160)
14   4.557030 10.10.10.16 → 10.10.20.17 SSHv2 570 0xfe6f (65135) Client: Encrypted packet (len=496)
15   4.557030 10.10.10.16 → 10.10.20.17 SSHv2 154 0xfe70 (65136) Client: Encrypted packet (len=80)
16   4.563026 10.10.10.16 → 10.10.20.17 TCP 74 0xfe72 (65138) 51661 → 22 [ACK] Seq=2614 Ack=3214 Win=71168 Len=0 TSval=433249860 TSecr=3052563818
17   4.564033 10.10.10.16 → 10.10.20.17 SSHv2 138 0xfe73 (65139) Client: Encrypted packet (len=64)
18   4.572029 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe7c (65148) Client: Encrypted packet (len=96)
19   4.572029 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe7d (65149) Client: Encrypted packet (len=96)
20   4.612020 10.10.10.16 → 10.10.20.17 SSHv2 202 0xfe82 (65154) Client: Encrypted packet (len=128)
21   4.622029 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x7e8c (32396) Client: Encrypted packet (len=8948)
22   4.622029 10.10.10.16 → 10.10.20.17 SSHv2 7574 0x7e8d (32397) Client: Encrypted packet (len=7500)
23   4.623021 10.10.10.16 → 10.10.20.17 SSHv2 766 0x7e90 (32400) Client: [TCP Previous segment not captured] , Encrypted packet (len=692)
24   4.623021 10.10.10.16 → 10.10.20.17 TCP 9022 0x7e8d (32397) [TCP Out-Of-Order] 51661 → 22 [ACK] Seq=19446 Ack=3870 Win=71168 Len=8948 TSval=433249866 TSecr=3052563824
25   4.624028 10.10.10.16 → 10.10.20.17 TCP 9022 0x7e8e (32398) [TCP Out-Of-Order] 51661 → 22 [ACK] Seq=28394 Ack=3870 Win=71168 Len=8948 TSval=433249866 TSecr=3052563824
26   5.215992 10.10.10.16 → 10.10.20.17 TCP 9022 0x0637 (1591) [TCP Retransmission] 51661 → 22 [ACK] Seq=37342 Ack=3870 Win=71168 Len=8948 TSval=433249926 TSecr=3052563824
27   5.787014 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x12ab (4779) Client: Encrypted packet (len=8948)
28   6.356992 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x135f (4959) Client: Encrypted packet (len=8948)
29   6.807017 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x16e7 (5863) Client: Encrypted packet (len=8948)
30   7.316985 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1799 (6041) Client: Encrypted packet (len=8948)
31   7.867011 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x184d (6221) Client: Encrypted packet (len=8948)
32   8.436974 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1bed (7149) Client: Encrypted packet (len=8948)
33   8.539025 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1bf0 (7152) Client: Encrypted packet (len=8948)
34   9.518030 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1d2a (7466) Client: [TCP Previous segment not captured] , Encrypted packet (len=8948)
35   9.519022 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1d2b (7467) Client: Encrypted packet (len=8948)
36  11.498983 10.10.10.16 → 10.10.20.17 TCP 9022 0x1ef4 (7924) [TCP Retransmission] 51661 → 22 [ACK] Seq=109618 Ack=3934 Win=71168 Len=8948 TSval=433250554 TSecr=3052564314
37  11.499974 10.10.10.16 → 10.10.20.17 TCP 9022 0x1ef7 (7927) [TCP Retransmission] 51661 → 22 [ACK] Seq=118566 Ack=3934 Win=71168 Len=8948 TSval=433250554 TSecr=3052564511
38  11.499974 10.10.10.16 → 10.10.20.17 TCP 9022 0x1ef8 (7928) [TCP Retransmission] 51661 → 22 [ACK] Seq=127514 Ack=3934 Win=71168 Len=8948 TSval=433250554 TSecr=3052564511
39  11.936008 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1f25 (7973) Client: Encrypted packet (len=8948)
40  12.496984 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x204e (8270) Client: Encrypted packet (len=8948)
41  13.096995 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x20e8 (8424) Client: Encrypted packet (len=8948)

Identify reason for TCP retransmission

I am experiencing slow SCP transfers between servers. MTU has been set to 9216 for all interfaces in the traffic path.

Below is the packet capture from an intermediate switch in the traffic path.

Any guidance will be appreciated!

TCP retransmission is occurring at packet 26,36,38.

1   0.000000 10.10.10.16 → 10.10.20.17 TCP 82 0xf762 (63330) 51661 → 22 [SYN, ECE, CWR] Seq=0 Win=65535 Len=0 MSS=8960 WS=512 SACK_PERM TSval=433249404 TSecr=0
2   0.000000 10.10.10.16 → 10.10.20.17 TCP 74 0xf763 (63331) 51661 → 22 [ACK] Seq=1 Ack=1 Win=71168 Len=0 TSval=433249404 TSecr=3052563362
3   0.000000 10.10.10.16 → 10.10.20.17 SSH 95 0xf764 (63332) Client: Protocol (SSH-2.0-OpenSSH_9.8)
4   0.029006 10.10.10.16 → 10.10.20.17 SSHv2 1290 0xf766 (63334) Client: Key Exchange Init
5   0.031004 10.10.10.16 → 10.10.20.17 SSHv2 154 0xf767 (63335) Client: Diffie-Hellman Key Exchange Init
6   0.039000 10.10.10.16 → 10.10.20.17 SSHv2 186 0xf768 (63336) Client: New Keys, Encrypted packet (len=96)
7   0.146996 10.10.10.16 → 10.10.20.17 SSHv2 138 0xf76b (63339) Client: Encrypted packet (len=64)
8   0.148003 10.10.10.16 → 10.10.20.17 SSHv2 154 0xf76c (63340) Client: Encrypted packet (len=80)
9   0.163001 10.10.10.16 → 10.10.20.17 SSHv2 186 0xf76f (63343) Client: Encrypted packet (len=112)
10   0.274995 10.10.10.16 → 10.10.20.17 TCP 74 0xf78e (63374) 51661 → 22 [ACK] Seq=1686 Ack=1870 Win=71168 Len=0 TSval=433249432 TSecr=3052563378
11   4.509028 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe60 (65120) Client: Encrypted packet (len=96)
12   4.526026 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe62 (65122) Client: Encrypted packet (len=96)
13   4.529032 10.10.10.16 → 10.10.20.17 SSHv2 234 0xfe63 (65123) Client: Encrypted packet (len=160)
14   4.557030 10.10.10.16 → 10.10.20.17 SSHv2 570 0xfe6f (65135) Client: Encrypted packet (len=496)
15   4.557030 10.10.10.16 → 10.10.20.17 SSHv2 154 0xfe70 (65136) Client: Encrypted packet (len=80)
16   4.563026 10.10.10.16 → 10.10.20.17 TCP 74 0xfe72 (65138) 51661 → 22 [ACK] Seq=2614 Ack=3214 Win=71168 Len=0 TSval=433249860 TSecr=3052563818
17   4.564033 10.10.10.16 → 10.10.20.17 SSHv2 138 0xfe73 (65139) Client: Encrypted packet (len=64)
18   4.572029 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe7c (65148) Client: Encrypted packet (len=96)
19   4.572029 10.10.10.16 → 10.10.20.17 SSHv2 170 0xfe7d (65149) Client: Encrypted packet (len=96)
20   4.612020 10.10.10.16 → 10.10.20.17 SSHv2 202 0xfe82 (65154) Client: Encrypted packet (len=128)
21   4.622029 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x7e8c (32396) Client: Encrypted packet (len=8948)
22   4.622029 10.10.10.16 → 10.10.20.17 SSHv2 7574 0x7e8d (32397) Client: Encrypted packet (len=7500)
23   4.623021 10.10.10.16 → 10.10.20.17 SSHv2 766 0x7e90 (32400) Client: [TCP Previous segment not captured] , Encrypted packet (len=692)
24   4.623021 10.10.10.16 → 10.10.20.17 TCP 9022 0x7e8d (32397) [TCP Out-Of-Order] 51661 → 22 [ACK] Seq=19446 Ack=3870 Win=71168 Len=8948 TSval=433249866 TSecr=3052563824
25   4.624028 10.10.10.16 → 10.10.20.17 TCP 9022 0x7e8e (32398) [TCP Out-Of-Order] 51661 → 22 [ACK] Seq=28394 Ack=3870 Win=71168 Len=8948 TSval=433249866 TSecr=3052563824
26   5.215992 10.10.10.16 → 10.10.20.17 TCP 9022 0x0637 (1591) [TCP Retransmission] 51661 → 22 [ACK] Seq=37342 Ack=3870 Win=71168 Len=8948 TSval=433249926 TSecr=3052563824
27   5.787014 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x12ab (4779) Client: Encrypted packet (len=8948)
28   6.356992 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x135f (4959) Client: Encrypted packet (len=8948)
29   6.807017 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x16e7 (5863) Client: Encrypted packet (len=8948)
30   7.316985 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1799 (6041) Client: Encrypted packet (len=8948)
31   7.867011 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x184d (6221) Client: Encrypted packet (len=8948)
32   8.436974 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1bed (7149) Client: Encrypted packet (len=8948)
33   8.539025 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1bf0 (7152) Client: Encrypted packet (len=8948)
34   9.518030 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1d2a (7466) Client: [TCP Previous segment not captured] , Encrypted packet (len=8948)
35   9.519022 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1d2b (7467) Client: Encrypted packet (len=8948)
36  11.498983 10.10.10.16 → 10.10.20.17 TCP 9022 0x1ef4 (7924) [TCP Retransmission] 51661 → 22 [ACK] Seq=109618 Ack=3934 Win=71168 Len=8948 TSval=433250554 TSecr=3052564314
37  11.499974 10.10.10.16 → 10.10.20.17 TCP 9022 0x1ef7 (7927) [TCP Retransmission] 51661 → 22 [ACK] Seq=118566 Ack=3934 Win=71168 Len=8948 TSval=433250554 TSecr=3052564511
38  11.499974 10.10.10.16 → 10.10.20.17 TCP 9022 0x1ef8 (7928) [TCP Retransmission] 51661 → 22 [ACK] Seq=127514 Ack=3934 Win=71168 Len=8948 TSval=433250554 TSecr=3052564511
39  11.936008 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x1f25 (7973) Client: Encrypted packet (len=8948)
40  12.496984 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x204e (8270) Client: Encrypted packet (len=8948)
41  13.096995 10.10.10.16 → 10.10.20.17 SSHv2 9022 0x20e8 (8424) Client: Encrypted packet (len=8948)