Ethereal-users: [Ethereal-users] TCP Retransmissions and resets: What is an "acceptable" rate of
I am wondering what is an acceptable rate of occurrence for TCP retransmissions and resets.
Let's say you open up capture of 10 minutes of Internet traffic for a small office LAN with 10 users and one switch/router/firewall, and you see retransmissions.
You examine a few of the connections closely for retransmissions and resets, and you don't see very many per connection, and you don't see the connection closing because of too many retransmissions. You just occasionally see one frame not get an acknowledgment quickly enough, and a single retransmission is sent because of a time out. Or occasionally, a connection is just closed with a reset, and you don't know if the user simply closed their browser in the middle of loading a page.
If you total the number of TCP frames per connection, and figure the retransmissions/resets rate per frame, you could get <1%, or 5%, or 10%.
One recent capture had 300 total retransmissions for one user, but the number of frames for this user was 21.531, for a rate of 1.39%. Do I ignore this as a normal occurrence?.
I expect some retransmissions/resets to be a "normal" event, but at what rate do you begin to be concerned?
Isn't some low rate such as 2% actually "normal" for an Internet connection?
Do you know a source for what is generally accepted to be a "normal" for TCP traffic?
And what if the traffic is for a small LAN, rather than for an Internet connection? What rate is acceptable for a LAN?
Doug (Gunndo)
