This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi I am capturing some traffic from multiple 10G interfaces to a laptop connected at 1Gbs. If applied a capture filter to specifically look for the IPs I need to investgate. In my capture files I see a lot of retransmissions, unseen segments and out-of-order segements. Is it possible that wireshark is seeing these due to packets getting lost to to the overload of the 1GBs connection? Thanks

asked 20 Sep '13, 00:38

murawai's gravatar image

murawai
1223
accept rate: 0%


Most certainly you have lost frames due to

  • the device that's aggregateing several 10G links to one 1G link is unable to do that (way too much traffic)
  • your laptop gets all frames, but is unable to write everything to disk

Your capture setup seems to be kind of under-sized for that kind of environment!

You could try to add filters on the aggregating device (n x 10G -> 1G) to limit the amount of traffic. However, that is no guarantee to overrun the 1G link.

If the laptop is the source of the problem, the only option is to get a device that is capable to handle a fully utilized 1G link.

Regards
Kurt

permanent link

answered 20 Sep '13, 00:56

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 20 Sep '13, 01:02

Hi - thanks it does sound likely & would make sense for the "TCP ACKed unseen segment" - however just to be sure can you confirm this would also explains why wireshark is seeing so many retransmissions, also out-of-order packets? If it makes sense for all these then thats great, I just did't want to ignore these "errors" if there was no sensible reason. Much appreciate your assistance Cheers

(22 Sep '13, 16:23) murawai

however just to be sure can you confirm this would also explains why wireshark is seeing so many retransmissions, also out-of-order packets?

without looking at the capture file neither can I confirm that nor can I decline it. Can you post a small sample capture file somewhere (google docs, dropbox, cloudshark)?

(22 Sep '13, 16:36) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×104
×36
×14

question asked: 20 Sep '13, 00:38

question was seen: 3,350 times

last updated: 22 Sep '13, 16:36

p​o​w​e​r​e​d by O​S​Q​A