I couldn't find a similar thread, sorry if this is a dup... I recently upgraded my Ubuntu 12.04 system, running the standard Wireshark 1.6.7, and am betting boatloads of "TCP ACKed lost segment" messages, as well as "TCP Previous segment lost", and sometimes I've even seen FCS errors. Some details about my environment:
I'm going to try installing a brand new Ubuntu 13.04 system, and will post the results, but if anybody has any ideas of what might be causing this, please send them my way. Thanks! asked 23 Sep '13, 15:14  chuck-tallac |
2 Answers:
This might be caused by 'offload' features enabled. Try disabling LRO TSO and GSO using the ethtool -k command A nice writeup on the ethtool can be found here answered 23 Sep '13, 22:19  mrEEde edited 23 Sep '13, 22:56 |
Based on that information, I assume you're capturing on the bridged interface of VirtualBox on Windows 8. If so, I'd like to refer you to similar problems posted here and in other forums.
There seems to be an ever recurring problem with VirtualBox and sniffing on the bridged interface. Maybe the update of your virtual machine (including kernel and network driver) broke something (like the internal handling of the VM traffic by the VirtualBox bridged interface) and thus you don't see some packets in Wireshark, if you capture on the bridged interface. Usually it works very well to use Wireshark within the virtual machine. Regards answered 24 Sep '13, 08:36  Kurt Knochner ♦ edited 24 Sep '13, 08:38 Thanks Kurt for the tip and pointers to those articles about wireshark and virtualbox. I suspect that you are correct regarding the updating of my VM causing some internal driver change that broke something in wireshark. I am stuck in that I must use bridged mode since I'm running services on my VMs that require communication from other external devices. I will keep poking around and reading more hints like the ones you posted to see if there is a reasonable workaround. Thanks again for the help! (24 Sep '13, 08:51) chuck-tallac
It did not break Wireshark. Most certainly it broke some functionality of the VirtualBox bridged interface ;-)
I've never found or heard of a reliable workaround, except capturing within the virtual machine. (24 Sep '13, 13:11) Kurt Knochner ♦ |
Thanks for the suggestion mrEEde - plus I now know a lot about ethtool that I didn't know before. Unfortunately though, turning off all the offloads, even some you didn't mention explicitly, has not resolved the issue. I'm still getting these errors. Thanks for the info however.