This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is someone willing to take a look at a capture of mine?

0

Hi, some users on my website are experiencing problems while uploading a file. The problem is that the uploading is extremely slowed down. Taking hours for a simple 2MB file upload. I haven't been able to reproduce the problem on my end.

Someone recommended me to use Wireshark to trace the packets. I installed it on my computer and made a capture of a upload that went pretty normal. When I review the capture I see quite a lot of black lines which I believe to be problem marked packets. This is all new to me and actually not making a lot of sense.

So my questions is: Is someone willing to take a look to see if something is really out of the ordinary? This capture is not from a session with extremely slow upload, but maybe issues can be extracted from it anyway?

asked 26 Nov '14, 04:22

lwvvliet's gravatar image

lwvvliet
11112
accept rate: 0%

If the capture doesn't contain sensitive information you could upload it to http://www.cloudshark.org and post the link here. Otherwise sanitize your file with TraceWrangler first: http://www.tracewrangler.com

(26 Nov '14, 04:42) Jasper ♦♦

Jasper, thanks for your response. I did what you suggested and uploaded the sanitized version. https://www.cloudshark.org/captures/b571559db283

I hope you can take a look! Thanks.

(26 Nov '14, 06:53) lwvvliet

One Answer:

0

Sorry, I didn't have time to take a look earlier. From what I see you have packet loss on the server side, which can delay the upload process quite a bit. Your trace is not really that bad, but it takes about 1 second in some cases to get the retransmission trough (e.g. packet 1932, retransmited in 2035). This happens a couple of times during the capture, so if other uploads experience more packet loss it could get a lot worse.

Next step should be to capture at the server to see if it even gets the original packets, or if they're lost (and how many of them). In your trace we see original and retransmission, so the loss is somewhere further up on the path to the server.

answered 06 Dec '14, 16:54

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%