The dreaded intermittent "network is slow" help with wireshark: Lots of TCP Out-of-Order

Posted on 2009-12-28
Last Modified: 2012-08-13
I am shooting an issue with intermittent network slowness. I checked my switches and the interfaces show no over utilization and no errors.  I don't see anything on the switches that stands out as an issue.

When I run wireshark I see lots of TCP Out-of-Order's 24,000 and 12000 duplicate ACKs in a 10 minute capture. Is this a problem  I attached images. The dup ip was corrected.

Does anything else stand out?
Question by:ttl1
    LVL 32

    Expert Comment

    by:Kamran Arshad

    Please read the below discussion;
    LVL 10

    Accepted Solution

    It really hard to make real headway given the little information supplied.  
    Screen-hunter-1: So you seem to have both duplicate ACK and small(er) TCP windows.  This usually (not always) points to the buffer at the receiver end filling up as the sender is sending faster than the receiver is receiving.  
    Screen-hunter-3: That's just bad.  Something is either sending corrupt packets or a device on the network is corrupting them in route or the receiving station (i.e.: the one running wireshark) is corrupting them.  All this will have to be re-transmitted.
    Screen-hunter-4:  Out of order may not necessarily be a problem.  Some network card re-order the packets & wireshark is not aware that the NIC has done this.  Duplicate IP address is REALLY bad - I assume you've corrected that.  And finally the 7 frames lost are probably because the receiver buffer is to small on the wireshark machine.

    Hope this helps.

    Author Closing Comment

    Thanks for helping me understand this.

    Featured Post

    Why You Should Analyze Threat Actor TTPs

    After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

    Join & Write a Comment

    In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
    Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now