[TCP retransmission]hyperV host to system center Virtual Machine Manager VMM

Question

Question: We are getting a lot of Expert(error notifications) about TCP Retransmissions, Reassembly error; New Fragment overlaps old data.(retransmission?).

The offending packets are happening between a hyperV node and the VMM. Should we be concerned or is this is false positive.

both servers are plugged in to the same switch, the hyper V node has a dedicated port and virtual network created for our server lan. The vmm is just a server that sits on the same vlan natively.

Summary...

3035    0.983810000 172.31.1.89 172.31.1.78 TCP 318 Note    [TCP Retransmission] 52503→5985 [PSH, ACK] Seq=2407 Ack=2911 Win=4100 Len=264
3036    0.983863000 172.31.1.89 172.31.1.78 TCP 1514        [TCP segment of a reassembled PDU]
3037    0.983864000 172.31.1.89 172.31.1.78 TCP 1514    Note    [TCP Retransmission] [TCP segment of a reassembled PDU]
3038    0.983865000 172.31.1.89 172.31.1.78 HTTP    736 Error   POST /wsman HTTP/1.1 [Malformed Packet]
3039    0.983866000 172.31.1.89 172.31.1.78 TCP 736 Error   [TCP Retransmission] 52503→5985 [PSH, ACK] Seq=4131 Ack=2911 Win=4100 Len=682[Reassembly error, protocol TCP: New fragment overlaps old data (retransmission?)]

Accepted Answer

we are chalking these up to false positives and microsoft doing some thing as usual that they are not supposed to be doing.

Answer 2

Well, since every frame is seen twice, did you by any chance capture on a span-port with the source being a vlan? Then it is a capturing artefact as every frame with first enter the vlan and then exit the vlan. When capturing on a vlan, better use "rx only" instead of "both".