This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tcp duplicate ack in MPTCP iscsi traffic

0

I am looking at the multi-path iscsi traffic trace and seeing occasional tcp duplicate acks.

3706 2013-11-08 14:02:09.353893 192.168.1.1 192.168.1.250 TCP [TCP Dup ACK 3704#1] 59969 > iscsi-target [ACK] Seq=11134753 Ack=5166528 Win=65535 Len=0 SLE=5175488 SRE=5193408

3708 2013-11-08 14:02:09.353927 192.168.1.1 192.168.1.250 TCP [TCP Dup ACK 3704#2] 59969 > iscsi-target [ACK] Seq=11134753 Ack=5166528 Win=65535 Len=0 SLE=5175488 SRE=5202368

3710 2013-11-08 14:02:09.353955 192.168.1.1 192.168.1.250 TCP [TCP Dup ACK 3704#3] 59969 > iscsi-target [ACK] Seq=11134753 Ack=5166528 Win=65535 Len=0 SLE=5175488 SRE=5205232

3712 2013-11-08 14:02:09.354131 192.168.1.1 192.168.1.250 TCP [TCP Dup ACK 3704#4] 59969 > iscsi-target [ACK] Seq=11134753 Ack=5166528 Win=65535 Len=0 SLE=5175488 SRE=5214192

3716 2013-11-08 14:02:09.354191 192.168.1.1 192.168.1.250 TCP [TCP Dup ACK 3704#5] 59969 > iscsi-target [ACK] Seq=11134753 Ack=5166528 Win=65535 Len=0 SLE=5175488 SRE=5223103

3722 2013-11-08 14:02:09.354414 192.168.1.1 192.168.1.250 TCP [TCP Dup ACK 3704#6] 59969 > iscsi-target [ACK] Seq=11134753 Ack=5166528 Win=65535 Len=0 SLE=5175488 SRE=5232063

if I interpreted rfc6824 correctly, [TCP Dup ACK] should not be a concern unless you get more than two in a row?

asked 08 Nov '13, 11:22

net_tech's gravatar image

net_tech
116303337
accept rate: 13%


One Answer:

1

Duplicate acks are sent immediately when packets arrive out of order. When the sender sees the 3rd (sometimes 2nd) duplicate ACK it considers the segment lost and starts a fast retransmission. Happens now and then in streaming traffic like your iSCSI. This trace shows that the SACK option is used on the session. The client is missing seq# 5166528 in the length of 8960 bytes and bytes 5175488-5232063 have successfully been received.

If it doesn't happen too often, it is nothing to be too concerned about

alt text

answered 08 Nov '13, 22:52

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

If it doesn't happen too often, it is nothing to be too concerned about

Got it, can you define "too often"

(09 Nov '13, 06:31) net_tech

This capture was done from one of 3 iscsi paths that this server has. I am also seeing missing segments, but that’s probably because they traveled over other iscsi links. Do I have to capture traffic on all 3 at the same time and then somehow merge all 3 captures in to one to see the whole picture?

(09 Nov '13, 06:36) net_tech

It depends what the throughput expectations are based on the infrastructure being used. A long distance connection surely suffers more often than a local Gb ethernet which is being used here as jumbo frames are being used. TCP will slow down when packet loss is detected, so in an iscsi environment I'd expect to see cloe to zero packet loss rate

(09 Nov '13, 06:47) mrEEde2