Having application slowdown issues when we try to access a large list or upload a file, but only through F5. The pic attached is sorted by length, and all of the packets with length 16114 were bad checksum as well as virtually any over 1500 size. The 16114 packets all happened when the upload starts. It happens with both 1 or 2 servers in the pool and does not happen if you bypass the F5 asked 19 Oct '16, 15:28  Mysta edited 19 Oct '16, 16:23 |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
That capture seems pretty much useless as it was most likely taken on one of the systems involved. It doesn't show what really happened on the network cable at all. See https://blog.packet-foo.com/2014/05/the-drawbacks-of-local-packet-captures/
Ahhh, so that's why there's so many bad checksum then? http://i.imgur.com/9iF0emB.png
Ethernet checksum errors are usually caused by Wireshark interpreting trailing bytes as checksum. It can't be a bad checksum because the frame would have been discarded and not captured if it were.
Well thanks for your help! In the past I was able to get a lot of data from the pcap but I see now that for real details you have to go with the mirrored solution. Great site you linked!