This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

DUP ACKS with RE TRANS HELP

0

I am getting these DUP and ReTRANS between CE & CE Routers. I have no filters in place, No ACl in place and No Policers in place. I cannot figure out where these are coming from.. If it is me or my ISP.. The whole path has been checked and tested from the ISP, The ISP has no Filters,ACL or policers in place as well.

http://i58.tinypic.com/2z4agy8.png

[IMG]http://i58.tinypic.com/2z4agy8.png[/IMG]

SCP test:

======= [email protected]:~$ scp [email protected]:ftp-file.pcap . [email protected]'s password: ftp-file.pcap 100% 4522KB 98.3KB/s 00:46
[email protected]:~$ scp ftp-file.pcap [email protected]: [email protected]'s password: ftp-file.pcap 100% 4522KB 83.7KB/s 00:54

iperf UDP test between Amsterdam and San Jose:

[email protected]:~$ sudo iperf -c 206.81.188.178 -P 1 -i 1 -l 1392.0B -f m -t 30 -u -b 20m -r [sudo] password for jding:


Client connecting to 206.81.188.178, UDP port 5001 Sending 1392 byte datagrams UDP buffer size: 0.12 MByte (default)



Server listening on UDP port 5001 Receiving 1392 byte datagrams UDP buffer size: 0.12 MByte (default)


[ 3] local 206.81.185.68 port 42943 connected with 206.81.188.178 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0- 1.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 1.0- 2.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 2.0- 3.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 3.0- 4.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 4.0- 5.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 5.0- 6.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 6.0- 7.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 7.0- 8.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 8.0- 9.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 9.0-10.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 10.0-11.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 11.0-12.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 12.0-13.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 13.0-14.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 14.0-15.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 15.0-16.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 16.0-17.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 17.0-18.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 18.0-19.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 19.0-20.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 20.0-21.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 21.0-22.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 22.0-23.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 23.0-24.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 24.0-25.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 25.0-26.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 26.0-27.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 27.0-28.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 28.0-29.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 29.0-30.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 0.0-30.0 sec 71.6 MBytes 20.0 Mbits/sec [ 3] Sent 53958 datagrams [ 3] Server Report: [ 3] 0.0-30.3 sec 33.7 MBytes 9.35 Mbits/sec 15.441 ms 28564/53957 (53%) [ 3] 0.0-30.3 sec 1 datagrams received out-of-order [ 4] local 206.81.185.68 port 5001 connected with 206.81.188.178 port 43552 [ 4] 0.0- 1.0 sec 1.15 MBytes 9.68 Mbits/sec 0.106 ms 919/ 1788 (51%) [ 4] 1.0- 2.0 sec 1.15 MBytes 9.68 Mbits/sec 0.134 ms 930/ 1799 (52%) [ 4] 2.0- 3.0 sec 1.15 MBytes 9.68 Mbits/sec 0.173 ms 929/ 1798 (52%) [ 4] 3.0- 4.0 sec 1.15 MBytes 9.69 Mbits/sec 0.190 ms 931/ 1801 (52%) [ 4] 4.0- 5.0 sec 1.15 MBytes 9.67 Mbits/sec 0.239 ms 928/ 1796 (52%) [ 4] 5.0- 6.0 sec 1.15 MBytes 9.68 Mbits/sec 0.211 ms 930/ 1799 (52%) [ 4] 6.0- 7.0 sec 1.15 MBytes 9.68 Mbits/sec 0.189 ms 927/ 1796 (52%) [ 4] 7.0- 8.0 sec 1.15 MBytes 9.69 Mbits/sec 0.148 ms 932/ 1802 (52%) [ 4] 8.0- 9.0 sec 1.15 MBytes 9.68 Mbits/sec 0.232 ms 929/ 1798 (52%) [ 4] 9.0-10.0 sec 1.15 MBytes 9.68 Mbits/sec 0.150 ms 930/ 1799 (52%) [ 4] 10.0-11.0 sec 1.15 MBytes 9.68 Mbits/sec 0.134 ms 929/ 1798 (52%) [ 4] 11.0-12.0 sec 1.15 MBytes 9.68 Mbits/sec 0.248 ms 929/ 1798 (52%) [ 4] 12.0-13.0 sec 1.15 MBytes 9.69 Mbits/sec 0.217 ms 931/ 1801 (52%) [ 4] 13.0-14.0 sec 1.15 MBytes 9.68 Mbits/sec 0.213 ms 929/ 1798 (52%) [ 4] 14.0-15.0 sec 1.15 MBytes 9.68 Mbits/sec 0.217 ms 929/ 1798 (52%) [ 4] 15.0-16.0 sec 1.15 MBytes 9.68 Mbits/sec 0.142 ms 929/ 1798 (52%) [ 4] 16.0-17.0 sec 1.15 MBytes 9.68 Mbits/sec 0.220 ms 929/ 1798 (52%) [ 4] 17.0-18.0 sec 1.15 MBytes 9.68 Mbits/sec 0.132 ms 929/ 1798 (52%) [ 4] 18.0-19.0 sec 1.15 MBytes 9.68 Mbits/sec 0.180 ms 930/ 1799 (52%) [ 4] 19.0-20.0 sec 1.15 MBytes 9.69 Mbits/sec 0.224 ms 930/ 1800 (52%) [ 4] 20.0-21.0 sec 1.15 MBytes 9.68 Mbits/sec 0.198 ms 930/ 1799 (52%) [ 4] 21.0-22.0 sec 1.15 MBytes 9.68 Mbits/sec 0.193 ms 929/ 1798 (52%) [ 4] 22.0-23.0 sec 1.15 MBytes 9.68 Mbits/sec 0.207 ms 929/ 1798 (52%) [ 4] 23.0-24.0 sec 1.15 MBytes 9.68 Mbits/sec 0.212 ms 929/ 1798 (52%) [ 4] 24.0-25.0 sec 1.15 MBytes 9.68 Mbits/sec 0.174 ms 929/ 1798 (52%) [ 4] 25.0-26.0 sec 1.15 MBytes 9.68 Mbits/sec 0.162 ms 929/ 1798 (52%) [ 4] 26.0-27.0 sec 1.15 MBytes 9.64 Mbits/sec 0.214 ms 933/ 1799 (52%) [ 4] 27.0-28.0 sec 1.15 MBytes 9.69 Mbits/sec 0.122 ms 931/ 1801 (52%) [ 4] 28.0-29.0 sec 1.15 MBytes 9.67 Mbits/sec 0.338 ms 929/ 1797 (52%) [ 4] 29.0-30.0 sec 1.15 MBytes 9.69 Mbits/sec 0.194 ms 930/ 1800 (52%) [ 4] 0.0-30.3 sec 34.6 MBytes 9.60 Mbits/sec 15.578 ms 27880/53956 (52%) [ 4] 0.0-30.3 sec 1 datagrams received out-of-order [email protected]:~$

iperf UDP test on server side:

[email protected]:~$ sudo iperf -s -P 1 -i 1 -l 1392.0B -f m -u [sudo] password for jding:


Server listening on UDP port 5001 Receiving 1392 byte datagrams UDP buffer size: 0.12 MByte (default)


[ 3] local 206.81.188.178 port 5001 connected with 206.81.185.68 port 42943 [ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams [ 3] 0.0- 1.0 sec 1.11 MBytes 9.34 Mbits/sec 0.166 ms 948/ 1787 (53%) [ 3] 1.0- 2.0 sec 1.13 MBytes 9.45 Mbits/sec 0.107 ms 951/ 1800 (53%) [ 3] 2.0- 3.0 sec 1.12 MBytes 9.37 Mbits/sec 0.143 ms 957/ 1798 (53%) [ 3] 3.0- 4.0 sec 1.13 MBytes 9.45 Mbits/sec 0.162 ms 950/ 1799 (53%) [ 3] 4.0- 5.0 sec 1.14 MBytes 9.52 Mbits/sec 0.235 ms 945/ 1800 (52%) [ 3] 5.0- 6.0 sec 1.12 MBytes 9.35 Mbits/sec 0.118 ms 957/ 1797 (53%) [ 3] 6.0- 7.0 sec 1.12 MBytes 9.39 Mbits/sec 0.150 ms 955/ 1798 (53%) [ 3] 7.0- 8.0 sec 1.13 MBytes 9.48 Mbits/sec 0.119 ms 948/ 1799 (53%) [ 3] 8.0- 9.0 sec 1.13 MBytes 9.49 Mbits/sec 0.145 ms 947/ 1799 (53%) [ 3] 9.0-10.0 sec 1.12 MBytes 9.39 Mbits/sec 0.158 ms 955/ 1798 (53%) [ 3] 10.0-11.0 sec 1.12 MBytes 9.41 Mbits/sec 0.123 ms 953/ 1798 (53%) [ 3] 11.0-12.0 sec 1.14 MBytes 9.52 Mbits/sec 0.116 ms 944/ 1799 (52%) [ 3] 12.0-13.0 sec 1.11 MBytes 9.33 Mbits/sec 0.120 ms 961/ 1799 (53%) [ 3] 13.0-14.0 sec 1.13 MBytes 9.51 Mbits/sec 0.170 ms 945/ 1799 (53%) [ 3] 14.0-15.0 sec 1.13 MBytes 9.51 Mbits/sec 0.149 ms 943/ 1797 (52%) [ 3] 15.0-16.0 sec 1.11 MBytes 9.34 Mbits/sec 0.197 ms 962/ 1801 (53%) [ 3] 16.0-17.0 sec 1.11 MBytes 9.34 Mbits/sec 0.149 ms 958/ 1797 (53%) [ 3] 17.0-18.0 sec 1.12 MBytes 9.42 Mbits/sec 0.111 ms 952/ 1798 (53%) [ 3] 18.0-19.0 sec 1.13 MBytes 9.50 Mbits/sec 0.181 ms 947/ 1800 (53%) [ 3] 19.0-20.0 sec 1.12 MBytes 9.37 Mbits/sec 0.183 ms 956/ 1797 (53%) [ 3] 20.0-21.0 sec 1.12 MBytes 9.40 Mbits/sec 0.117 ms 955/ 1799 (53%) [ 3] 21.0-22.0 sec 1.13 MBytes 9.45 Mbits/sec 0.209 ms 951/ 1800 (53%) [ 3] 22.0-23.0 sec 1.13 MBytes 9.45 Mbits/sec 0.178 ms 948/ 1797 (53%) [ 3] 23.0-24.0 sec 1.13 MBytes 9.44 Mbits/sec 0.154 ms 952/ 1800 (53%) [ 3] 24.0-25.0 sec 1.13 MBytes 9.47 Mbits/sec 0.206 ms 947/ 1797 (53%) [ 3] 25.0-26.0 sec 1.12 MBytes 9.43 Mbits/sec 0.143 ms 952/ 1799 (53%) [ 3] 26.0-27.0 sec 1.12 MBytes 9.41 Mbits/sec 0.159 ms 954/ 1799 (53%) [ 3] 27.0-28.0 sec 1.12 MBytes 9.37 Mbits/sec 0.152 ms 957/ 1798 (53%) [ 3] 28.0-29.0 sec 1.13 MBytes 9.47 Mbits/sec 0.146 ms 949/ 1799 (53%) [ 3] 29.0-30.0 sec 1.11 MBytes 9.33 Mbits/sec 0.196 ms 961/ 1799 (53%) [ 3] 0.0-30.3 sec 33.7 MBytes 9.35 Mbits/sec 15.442 ms 28564/53957 (53%) [ 3] 0.0-30.3 sec 1 datagrams received out-of-order


Client connecting to 206.81.185.68, UDP port 5001 Sending 1392 byte datagrams UDP buffer size: 0.12 MByte (default)


[ 3] local 206.81.188.178 port 43552 connected with 206.81.185.68 port 5001 [ 3] 0.0- 1.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 1.0- 2.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 2.0- 3.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 3.0- 4.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 4.0- 5.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 5.0- 6.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 6.0- 7.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 7.0- 8.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 8.0- 9.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 9.0-10.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 10.0-11.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 11.0-12.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 12.0-13.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 13.0-14.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 14.0-15.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 15.0-16.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 16.0-17.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 17.0-18.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 18.0-19.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 19.0-20.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 20.0-21.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 21.0-22.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 22.0-23.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 23.0-24.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 24.0-25.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 25.0-26.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 26.0-27.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 27.0-28.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 28.0-29.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 29.0-30.0 sec 2.39 MBytes 20.0 Mbits/sec [ 3] 0.0-30.0 sec 71.6 MBytes 20.0 Mbits/sec [ 3] Sent 53958 datagrams [ 3] Server Report: [ 3] 0.0-30.3 sec 34.6 MBytes 9.60 Mbits/sec 15.577 ms 27880/53956 (52%) [ 3] 0.0-30.3 sec 1 datagrams received out-of-order [email protected]:~$

CE to CE ping test:

AMSRTRVPN01#ping 172.16.163.18 size 1500 repeat 1000 Success rate is 99 percent (995/1000), round-trip min/avg/max = 160/161/424 ms

asked 27 Oct '14, 20:46

fiber_cut's gravatar image

fiber_cut
11113
accept rate: 0%


3 Answers:

0

I would suggest to change your View for Time display format to show Seconds Since Previous Captured Packet. By doing so you might see that this is occurring in Microseconds rather than Milliseconds. Have you reviewed the buffers on the routers? This type of problem might be related to buffer size and not allowing enough time or small buffer size. I base this on that you have validated that there is no congestion along the path.

answered 28 Oct '14, 07:30

EdJ's gravatar image

EdJ
166610
accept rate: 0%

0

Duplicate ACKs and Retransmissions are a sign of packet loss. It is also possible for Wireshark to mis-identify Out-of-order packets as retransmissions, although I don't think that is happening here. Beyond that, we can't help much, because you've given us a screen shot instead of an actual Wireshark packet capture.

To find out where packets are being lost, first cut your capture file down to a single TCP stream. Find a packet that Wireshark identifies as a retransmission and filter on the TCP sequence number. If you see only one packet (the retransmission), then you are downstream from the point of packet loss, and you need to move your capture point toward the sender to find the device that is dropping packets.

If you see two packets (both the original and the retransmission), then you are upstream from the point of packet loss, and you need to move towards the receiver to find the device that is dropping packets.

answered 28 Oct '14, 10:48

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

0

I was told by a friend that looked at the pcap file, He says there is a 10m cap in one direction.. I don't see where he see's that.. Does anyone see that?

I posted the AMS pcap earlier and I jsut did one in opposite direction from SJC.. But I uploaded both files and links are below..

https://www.dropbox.com/s/6do5r1hqsd4oklm/TCKTticketId-8169616v0_capture-slow-in-sjo.pcap?dl=0

https://www.dropbox.com/s/fnbnfmjs4x6l9u0/TCKTticketId-8169616v0_capture-slow-in-ams.pcap?dl=0

I am also noticing odd window sizes, Could this boil down to that?

Thank you all!

answered 28 Oct '14, 19:08

fiber_cut's gravatar image

fiber_cut
11113
accept rate: 0%

edited 28 Oct '14, 19:18