This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the best way to filter traffic to see why a pair of servers which are built identical, one of them will cause the network to come to a screeching halt while the other one quietly does its job and works properly? SQL is running on them for an application. I have a capture of both of them, the noisy ones expert info shows

ACKed segment that wasn't captured (common at capture start)1026 The transmission window is now completely full 154 TCP 'Previous segment not captured (common at capture start)' There are about 20 connection resets and 18 TCP zero window segment.

Thanks in advance

asked 01 Jun '15, 10:44

MacBee's gravatar image

MacBee
6112
accept rate: 0%


A server that brings "the network to a screeching halt"?! That sounds really strange, because servers should not have that much power over the network performance, and if they do something is really really going wrong.

Can you share your captures? Because your symptoms are not really telling much. "Previous segment not captured" could be packet loss, but they can also be dropped packets. Connection resets are normal as well these days and need closer investigation to see if they mean trouble. Zero Window is most interesting, as it points to a performance problem of the server that sends the Window size of zero.

Use http://www.cloudshark.org if you can share the capture, if not, see if you can sanitize it with TraceWrangler first.

permanent link

answered 01 Jun '15, 10:52

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

I ran the tracewrangler on it but the file size is too large according to the cloudshark site..they are 50Megabyte and larger..

B

(01 Jun '15, 11:52) MacBee

Okay, then maybe you got access to something like Dropbox that doesn't restrict your file size?

(01 Jun '15, 11:59) Jasper ♦♦

Yes I do, if you send me your email address I will send you a link.

Bee

(01 Jun '15, 13:18) MacBee

Okay, send it to jasper [ät] packet-foo.com

(01 Jun '15, 15:09) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×319
×115
×8
×5
×2

question asked: 01 Jun '15, 10:44

question was seen: 1,393 times

last updated: 01 Jun '15, 15:09

p​o​w​e​r​e​d by O​S​Q​A