This is a general question. We have an WAN based enterprise application where most sites traverse 8-12 hops before getting to a data center load balancer (CISCO 6509E) which sprays to a web server cluster. Using WireShark we are getting lost of re-transamissions (4%) coming from the load balancer at the TCP level, but when we look at the devices along the path, we are not seeing any switch port errors along the way. I know that Ethernet is not responsible for reporting dropped packets, its the job of TCP. However, would I not see some error counter on the NIC cards (servers) or switch ports along the way? Is it possible to see that packet loss that we have seen yet not see anything on any of the switch ports? Switch Name/ interface Time Max Utilization Queue Drops In/Out Tester Connection MITC Data center INTERNET DMZ HRCMS server farms asked 04 Dec '13, 14:48  Zoberist |
One Answer:
Are you sure that these are really retransmissions? Wireshark has a habit of marking packets as "Retransmission" when they're just "Out-of-Order", and those are a lot less problematic (well, in most cases they are no problem at all) than real packet loss. Even with retransmissions you need to ask yourself if they really have an impact on your application, because if the recovery is so fast that the user doesn't even notice the lost packets you might not want to waste time on tracking them down. You should determine if the packet loss really occurred by looking at the TCP sequence and acknowledgement numbers. If there is packet loss then you should see that the client is using duplicate ACKs to signal the missing segment and a retransmission arriving for that segment. Please keep in mind that the TCP expert of Wireshark does not care about the RTT of the connection and flags packets as retransmissions if they arrive more than 3ms after the segment should have arrived in the first place. The 3ms is hard coded. If your connection has a RTT that is higher than that (which I guess from your description is probably has) you can easily run into the problem that the expert marks packets as retransmissions while they are Out-of-Orders in fact. This happens a lot if WAN acceleration devices are in use, because they often seem to reorder packets to optimize throughput and/or latency. answered 04 Dec '13, 15:43  Jasper ♦♦ |
