This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have an application that is communicating to a SQL server. Every once in a while, the queries the application calls are taking much longer. I've captured this with Wireshark. When everything is going fine, the log looks like this. These 5 entries take about 1ms.

Client -> SQL Server : Remote Procedure Call

SQL Server -> Client: Response

Client -> SQL Server : SQL Batch

SQL Server -> Client : [ACK] Seq=3218061 Ack=4449533 Win=131328 Len = 0

SQL Server -> Client: Response

When things start to get slow, the SQL Server/Client communication looks like this. The entire transaction takes about 500ms

Client -> SQL Server : Remote Procedure Call

SQL Server -> Client: Response

Client -> SQL Server : SQL Batch

SQL Server -> Client : [ACK] Seq=3222735 Ack=4458045 Win=131328 Len = 0 (Packet length = 60)

Client -> SQL Server: [ACK] Seq=596422 Ack=560033 Win=65280 Len = 0 (Packet length = 54)

SQL Server -> Client: Response

Notice the extra ACK from the client to the server. There is also a mixture of ARP requests in there, SSDP Notify's, STP, NBNS. I'm not sure why there are a bunch of other calls in there suddenly when there weren't before, but from everything I've found it should be pretty harmless. What I don't understand is why would the client be sending an ACK back to the SQL server? Any thoughts? Thanks in advance.

asked 22 Oct '15, 07:23

kw2107's gravatar image

kw2107
6112
accept rate: 0%


ACK is a TCP feature (Layer 4) to assure that the segments are transmitted correctly. For example to show the sender that all transmitted segments have reached its destination.

A response is an application things and is different from application to application. The TCP behaviour is equal to all applications the at use the TCP.

permanent link

answered 22 Oct '15, 09:41

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 22 Oct '15, 09:42

Sure, I understand that. I guess my question is why does the client sometimes send back an ACK and sometimes it doesn't? And when it does send back the ACK, there is a 500ms delay in the SQL server response?

(22 Oct '15, 10:03) kw2107

Depends on the moment. Without a trace I can't say much more. But in fact every packet is an ACK, too.

(22 Oct '15, 10:13) Christian_R
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139
×21

question asked: 22 Oct '15, 07:23

question was seen: 1,873 times

last updated: 22 Oct '15, 10:13

p​o​w​e​r​e​d by O​S​Q​A