I am troubleshooting periodic slowness in a streaming application running over the Internet. A trace from the client shows duplicate ack storms occasionally, which is not unusual in itself. WHat is odd is that wireshark is reporting up to 300 dup ack's for the same sequence before a Fast Retransmit comes through from the server. I've tested this using the same client against two different servers of the same type with the same application located on different host sites and I'm getting dup ack retries of between 15 and 300. It is my understanding that most stacks have the default maxdupack value somewhere between 1 and 3 I can't post the trace due to confidentiality, but here is the export using tcp.analysis.duplicate_ack filter from one server asked 04 Sep '14, 11:16  DICOM_Tracer edited 04 Sep '14, 11:17  Jasper ♦♦ |
One Answer:
Diagnosing things with huge ASCII dumps is really painful, so I doubt many of us will spent any amount of time on trying to figure things out with it. A trace would be much more useful, and if you're concerned about confidentiality you can use TraceWrangler to sanitize your trace. In your case you can strip all TCP payload since this is strictly a TCP layer problem (well, it shows on TCP, but you have most likely a buffer problem). Let me guess - the trace is a conversation where the sender has a bandwith larger than the target, maybe by factor 10 (e.g. a file server on a 1G link, with a client on 100MBit, or 10G to 1G)? Your trace shows the typical result of a huge amount of packets filling up a buffer somewhere (e.g. on a router or a switch port) and packet loss occurs. The receiver sends duplicate ACKs and the sender triggers a fast retransmission, but unfortunately that retransmission has to get in line at the end of the (still completely filled) buffer - which is why it takes so long to get through, and which is also why you see so many dup acks. By the way, this is not a lot of dup acks - I had a trace where there were over 1000 of them for a 10G -> 1G -> 100 Mbit connection, with double buffering. Just guessing, because there isn't much more I can do with a partial ASCII dump ;-) answered 04 Sep '14, 11:25 Jasper ♦♦ edited 04 Sep '14, 11:26 |
Thank you for the response. I understand the limited value of the ascii dump. You're reply was appreciated. We had come to a similar understanding but it is helpful to someone else's experience.