This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I apologise in advance but i'm just learning about Wireshark. I'm an engineer who works for company that does the IT for medical centres. I was asked to investigate a strange issue that has been affecting the site for the last 7 months. Every four weeks on a wednesday, without fail, the entire site grinds to a crawl. There has been investigations by the tech team, and BT, but they cannot seem to find where the problem is coming from. They asked me to run a Wireshark capture. I did this on a day that the site was running fine, and on a day it was crawling. Someone else will get to look at this, but it interests me as well. Would there be anything specific you'd be looking for if you were in this situation? Kind regards. Darren

asked 15 Dec '15, 13:40

1470's gravatar image

1470
6112
accept rate: 0%


I would start from looking at the following things:

  • unusually high volume of traffic (go Statistics -> Conversations, sort by number of packets and by number of bytes by clicking the column header), aka "someone is downloading films" or "something is doing a monthly backup"

  • unusually high number of tcp retransmissions, aka "something is wrong on the uplink connection" (display filter tcp.analysis.retransmission).

The two may be related together, as if there is a traffic shaping policy on the uplink (which is quite likely), attempts to transfer high volumes of data will cause packets to be dropped and thus retransmitted.

permanent link

answered 15 Dec '15, 13:52

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Thank you Sindy. Very kind of you to answer so soon.

(15 Dec '15, 14:07) 1470
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×14

question asked: 15 Dec '15, 13:40

question was seen: 725 times

last updated: 15 Dec '15, 14:20

p​o​w​e​r​e​d by O​S​Q​A