This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

We keep seeing lots of "TCP Re-transmission", "TCP DUP Ack" & "TCP Fast Re-transmission" in Wireshark. It appears to us that EVERY TIME the client is sending a request followed by a re-transmission almost immediately. Are we doing any thing wrong on the client side? or even on the server side? Is there any timer we could properly adjust to prevent the inappropriate re-transmission?

Pls. see attached. The client is 10.10.10.70 and the server is 192.168.1.52

Any help clearing this issue is appreciated.

Thank you,

asked 13 Feb '17, 11:53

Khojal's gravatar image

Khojal
6223
accept rate: 0%


Looks like you captured duplicate packets. Please check out this blog post:

https://blog.packet-foo.com/2015/03/tcp-analysis-and-the-five-tuple/

permanent link

answered 13 Feb '17, 11:57

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Seems like you have captured all frames twice. Please try editcap -D which comes within the wireshark packege, to eleminate the 'red herings'.

permanent link

answered 13 Feb '17, 11:57

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

You right. Thank you Jasper and Christian. That was very helpful.Some how we were capturing twice; however, after we adjusted the capture, we now only see the TCP retransmission issue EVERY TIME the client is requesting a "GetMenuWithPermissions". The server starts to send aalt text retransmission after about 10 Milli-seconds is it doesn't get an "ACK" from the client? Are we doing any thing wrong from the client or from the server? do we need to adjust any timer for the server re-transmission. Again this issue happens only when the client wants to get "GetMenuWithPermission". Please see attached screen capture.

Thank you

(13 Feb '17, 12:55) Khojal
1

Your capture technique is still not 100% accurate - you have packets way too big, over 4k for the "200 OK"... I recommend not capturing locally on any device involved, but use a SPAN port or TAP instead. Otherwise you'll still be chasing ghosts.

(13 Feb '17, 13:03) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×139
×17
×5
×1

question asked: 13 Feb '17, 11:53

question was seen: 3,965 times

last updated: 13 Feb '17, 13:03

p​o​w​e​r​e​d by O​S​Q​A