Anonymous_User Absent Member.
Absent Member.
3851 views

Packet trace: Lots of Duplicate Ack or Acked lost segment

I was playing with ethereal by doing some tests on our network and I realised that when I read a big file from a NW6.5SP5 server I get a lot of "Duplicate Ack" and when I write the same file back to the server I get a lot of "Bad checksum/Detected New server session". When I disable the checksum verification in ethereal the error transforms in "Acked lost segment".

Is that something to worry about ?

Thanks,

Antonio
Labels (1)
0 Likes
5 Replies
Anonymous_User Absent Member.
Absent Member.

Re: Packet trace: Lots of Duplicate Ack or Acked lost segment

Hi.

Yes, that is something to worry about. Looks like rather severe
low-level communications problem, possibly a duplex mismatch.

CU,
--
Massimo Rosen
Novell Support Connection Sysop
No emails please!
http://www.cfc-it.de
0 Likes
Anonymous_User Absent Member.
Absent Member.

=?ISO-8859-1?Q?R=E9p.=20:=20Re:=20Packet=20trace:=20Lots=20of=20D?==?ISO-8859-1?Q?uplicate=20Ack=20or=20Acked=20lost=20segment?=

But then how come when I look at the statistics on the server, on the station or on the switch, I see no errors ?

Antonio

>>> Massimo Rosen<mrosenno@spamcfc-it.de> 10/18/06 10:37 am >>>

Hi.

Yes, that is something to worry about. Looks like rather severe
low-level communications problem, possibly a duplex mismatch.

CU,
--
Massimo Rosen
Novell Support Connection Sysop
No emails please!
http://www.cfc-it.de
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: =?iso-8859-1?Q?R=E9p=2E?= : Re: Packet trace: Lots of Duplicate Ackor Acked lost segment

Hi,

> Antonio Saraca wrote:
>
> But then how come when I look at the statistics on the server, on the
> station or on the switch, I see no errors ?


Impossible to say. Of course, that could indicate the problem is
isolated to the workstation. A good idea is to take two traces
similarily, one on the WS, and one on the Server, and then check if
there's differences, e.g if there are packets the server sends, but the
WS never receives, or vice versa.

CU,
--
Massimo Rosen
Novell Product Support Forum Sysop
No emails please!
http://www.cfc-it.de
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: =?ISO-8859-1?Q?R=E9p.=20:=20Re:=20Packet=20trace:=20Lots=20of?==?ISO-8859-1?Q?=20Duplicate=20Ack=20or=20Acked=20lost=20segment?=

By doing some more research, I realized that on one server (using tcpcon) I have 0.4% of packets that are retransmitted (this is our main server). On other servers, this percentage can go as low as 0.06%. Is 0.4% a problem ? What can I do to decrease this value ?

Antonio

>>> Massimo Rosen<mrosenno@spamcfc-it.de> 10/18/06 1:33 pm >>>

Hi,

> Antonio Saraca wrote:
>
> But then how come when I look at the statistics on the server, on the
> station or on the switch, I see no errors ?


Impossible to say. Of course, that could indicate the problem is
isolated to the workstation. A good idea is to take two traces
similarily, one on the WS, and one on the Server, and then check if
there's differences, e.g if there are packets the server sends, but the
WS never receives, or vice versa.

CU,
--
Massimo Rosen
Novell Product Support Forum Sysop
No emails please!
http://www.cfc-it.de
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: =?ISO-8859-15?Q?R=E9p=2E_=3A_Re=3A_Packet_trace=3A_?==?ISO-8859-15?Q?Lots_of_Duplicate_Ack_or_Acked_lost_segmen?==?ISO-8859-15?Q?t?=

A figure that low probably means that there is no issue on the server,
but that some clients connected to the server have a problem.

Example 100 PCs attach to the server.
99 PCs have no problems and do not drop packets.
1 PC losses 1/2 its packets and they must be retransmitted.

As a result 0.5% of the packets are retransmitted.

Try copying a large file to and from the server a few different times on
some workstations. In general, the speed will be far greater on PCs w/o
issues than PCs with issues. This is a test I often have front-line
techs do since they are not trained enough for higher level analysis.




Antonio Saraca wrote:
> By doing some more research, I realized that on one server (using
> tcpcon) I have 0.4% of packets that are retransmitted (this is our main
> server). On other servers, this percentage can go as low as 0.06%. Is
> 0.4% a problem ? What can I do to decrease this value ?




--
Craig Wilson
Novell Product Support Forum Sysop
Master CNE, MCSE 2003, CCN
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.