This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Flooded network due to [TCP Retransmission] localinfosrvr > hp-pdl-datastr [SYN] packets

0

Hi all:

I have a LAN (~100 PC's, 10 servers, 6 Enterasys B3G124-48) that is having 3/4 blackouts a day; blackout meaning all switches ports blinking at the same time, big latency, and hughe packet loss, with no other solution rather than turning switches and routers off, wait, turn them on, and OK.

My first approach (quite newbie to this), is to "turn on" Wireshark when the blackout happens: what I can see at that particular moment is 99.9% of packets like this:

192.168.4.250 192.168.4.191 TCP 62 [TCP Retransmission] localinfosrvr > hp-pdl-datastr [SYN] Win = 65535 Len=0

Sometimes these are the IP's involved, and sometimes there are others; already updated Enterasys firmware to latest versión, changed Network cards, updated drivers, updated A.Virus, updated the Windows/Linux end PC's, changed ports in the switches, changed some network cables, etc. I am quite desperated....

This LAN is conected to the Internet and to other networks through optical fiber provided by the Spanish "big Telecom company". After Googling this, I can't see a clear direction about where to fight this. Could anyone please give a hint?.

Thank you in advance, sorry for my por english, and maybe for the lame question.....

P.

asked 18 Dec '13, 02:10

pdrinio's gravatar image

pdrinio
11112
accept rate: 0%


One Answer:

0

what I can see at that particular moment is 99.9% of packets like this:
192.168.4.250 192.168.4.191 TCP 62 [TCP Retransmission] localinfosrvr > hp-pdl-datastr [SYN] Win = 65535 Len=0

Looks like Wireshark sees the same frame again and again.

Could anyone please give a hint?.

As per your description, it sounds like a Layer 2 loop to me (someone created a ring by patching the wrong switch ports together). Did you check that? Do you run (rapid) spanning tree on your switches? If you don't know how to enable that, please ask your local Enterasys guru.

Regards
Kurt

answered 18 Dec '13, 03:57

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%