Solved

Packet Decoding

Posted on 2008-10-08
6
229 Views
Last Modified: 2012-06-21
After users complaining of network slowness I ran a tcp dump on a server and noticed many

TCP      [TCP Out-Of-Order] 9042 > 52734 [PSH, ACK] Seq=352279 Ack=334509 Win=64076 Len=1460

TCP      [TCP Dup ACK 17864#2] 52734 > 9042 [ACK] Seq=334509 Ack=340599 Win=32768 Len=0

Any tips? Advice

Thanks
0
Comment
Question by:willbaclimon
  • 2
  • 2
6 Comments
 
LVL 57

Accepted Solution

by:
giltjr earned 300 total points
ID: 22677229
The out of order packet indicates that someplace you have two paths between the hosts and that packets are being received out of order.

The duplicate ACK means that somewhere a packet was dropped and the remote side did not see what it expects so it resent the ACK.

Both of these error are normally an indication that there is something in the network path that is saturated, that is running above and beyond it capacity.

I would start looking at link utilization on any WAN links that this traffic may go over.  I would also check to see if you have any old routers that may be being pushed beyond their design capacity.
0
 
LVL 32

Assisted Solution

by:harbor235
harbor235 earned 200 total points
ID: 22677916


I agree with gilltjr, Out of order segements and duplicate acks are a sign of congestion, either on the network or on the end systems.

harbor235 ;}
0
 
LVL 7

Author Comment

by:willbaclimon
ID: 22681663
Thank you  both....This is a lan based server application with gig connectivity. I have checked network utilization, switch ports errors, crc's etc.. No luck so far. Although this is a sign of network congestion or issue, I believe it might be application due to this app being in development...Is there any way to prove that?


0
 
LVL 57

Expert Comment

by:giltjr
ID: 22681809
Where did you run the packet capture from?  The server, a mirrored port of something, your desktop?

There is absolutely no way that somebody could connect to this box over a WAN, like say the Internet?

In the dump you should have the 2 IP addresses that this connection deals with and you need to look at the full network path between those two devices.
0
 
LVL 7

Author Comment

by:willbaclimon
ID: 22723496
The issue winded up being the linux server nic drivers.

0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Setting up a VPN 60 182
managing a small network 6 97
looking for a program or router to monitor internet connection 4 69
Cisco WRVS4400N 11 37
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question