Ethereal-users: RE: [Ethereal-users] TCP Retransmissions and resets: What is an"acceptable" rate
Doug,
Be
careful trusting the Ethereal analysis of what packets are
retransmissions. I believe there is a bug and it actually ends up
calculating a lot of out-of-orders as retransmissions (one key looking for this
is the "dup ack"). Really, on a local LAN you should be seeing very few
retransmission or out of order packets. However, all bets are off when you go
out on the Internet. If you are seeing true retransmission of greater than 1% on
your local LAN, you should probably look into the issue further. If I didn't
have a lot to do, I would probably look into it if I were consistently
seeing any at all (percentage or no). If you are seeing out-of-order
packets on a local LAN that is something you should look into as well. Usually
you just see out-of-order packets on the WAN/Internet where the multiple paths
will mess things up. We have a problem with a multilink frame relay interface
here. Small packets can outrun the larger ones and cause our systems to send out
duplicate ACK's which waste bandwidth. For your WAN interface, retransmission
rates of 1% are not abnormal but if it is a new issue you might want to look
around and see if anything looks wrong. Possibly have the provider perform some
testing as well. If I were seeing rates over 5% I would probably start
bugging the provider (assuming all my equipment was working).
All
well and good, but how do you tell if it is a true retransmission or not? You
can manually examine the trap, which is a pain. I found some software
called "TCPTrace". I ran that and it picked up the real retransmissions and
classified the rest as out-of-orders. Not that I am precisely certain it is
accurate, but it is more accurate then Ethereal.
Brian
