This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Having application slowdown issues when we try to access a large list or upload a file, but only through F5. The pic attached is sorted by length, and all of the packets with length 16114 were bad checksum as well as virtually any over 1500 size. The 16114 packets all happened when the upload starts. It happens with both 1 or 2 servers in the pool and does not happen if you bypass the F5

asked 19 Oct '16, 15:28

Mysta's gravatar image

Mysta
6113
accept rate: 0%

edited 19 Oct '16, 16:23

1

That capture seems pretty much useless as it was most likely taken on one of the systems involved. It doesn't show what really happened on the network cable at all. See https://blog.packet-foo.com/2014/05/the-drawbacks-of-local-packet-captures/

(19 Oct '16, 15:33) Jasper ♦♦

Ahhh, so that's why there's so many bad checksum then? http://i.imgur.com/9iF0emB.png

(19 Oct '16, 15:53) Mysta
1

Ethernet checksum errors are usually caused by Wireshark interpreting trailing bytes as checksum. It can't be a bad checksum because the frame would have been discarded and not captured if it were.

(19 Oct '16, 15:59) Jasper ♦♦

Well thanks for your help! In the past I was able to get a lot of data from the pcap but I see now that for real details you have to go with the mirrored solution. Great site you linked!

(19 Oct '16, 16:02) Mysta
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×55
×36
×8
×4

question asked: 19 Oct '16, 15:28

question was seen: 724 times

last updated: 19 Oct '16, 16:23

p​o​w​e​r​e​d by O​S​Q​A