This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

high value in “bytes in flight” and alot retranmission

0

Hi, after reading on "bytes in flight", if in my network i saw a high value under "bytes in flight" and sub sequences a lot retransmission, does it mean the remote side is no processing the data fast enough, so the acknowledgment are no being able send back. Due to this it cause the client to retransmit the data again ? to over come this issue? do i need to slim down the bandwidth for connecting to the server side(WAN) ?

asked 15 Apr '13, 10:22

splibytes's gravatar image

splibytes
11●4●4●5
accept rate: 0%

One Answer:

2

High values of byte in flight may have two major reasons:

  1. the receiving node is slow when processing incoming data, which leads to acknowledges being delayed
  2. the RTT of the link is pretty high, so the sender has to push out a lot of data before the first acknowledge can even make it back to him

You'll need to check your initial RTT (from the TCP handshake) to be able to tell if the second version is likely or not. Sometimes retransmissions are needlessly issued when a sender gets nervous and sends retransmissions just because the acknowledge takes too long to come back, but you may also have real packet loss. Which is which is something that you need to analyze in your trace - needless retransmissions are usually identified by seeing both retransmission and original, as well as often getting a DSACK option in the acknowledges.

answered 15 Apr '13, 10:31

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

thanks, i found that is does have both retransmission and original ack and the server reply a dsack to the client, sound like packet drop do happen some where in the network.

(15 Apr '13, 18:32) splibytes