The dreaded intermittent "network is slow" help with wireshark: Lots of TCP Out-of-Order

I am shooting an issue with intermittent network slowness. I checked my switches and the interfaces show no over utilization and no errors.  I don't see anything on the switches that stands out as an issue.

When I run wireshark I see lots of TCP Out-of-Order's 24,000 and 12000 duplicate ACKs in a 10 minute capture. Is this a problem  I attached images. The dup ip was corrected.

Does anything else stand out?
ScreenHunter-01-Dec.-28-11.41.gif
ScreenHunter-03-Dec.-28-11.44.gif
ScreenHunter-04-Dec.-28-11.44.gif
ttl1Asked:
Who is Participating?
 
elf_binCommented:
It really hard to make real headway given the little information supplied.  
Screen-hunter-1: So you seem to have both duplicate ACK and small(er) TCP windows.  This usually (not always) points to the buffer at the receiver end filling up as the sender is sending faster than the receiver is receiving.  
Screen-hunter-3: That's just bad.  Something is either sending corrupt packets or a device on the network is corrupting them in route or the receiving station (i.e.: the one running wireshark) is corrupting them.  All this will have to be re-transmitted.
Screen-hunter-4:  Out of order may not necessarily be a problem.  Some network card re-order the packets & wireshark is not aware that the NIC has done this.  Duplicate IP address is REALLY bad - I assume you've corrected that.  And finally the 7 frames lost are probably because the receiver buffer is to small on the wireshark machine.

Hope this helps.
0
 
Kamran ArshadIT AssociateCommented:
Hi,

Please read the below discussion;

http://www.firewall.cx/ftopict-3590.html
0
 
ttl1Author Commented:
Thanks for helping me understand this.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.