Ethereal-users: Re: [Ethereal-users] Multiple retransmissions

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Mon, 21 Nov 2005 23:56:20 +0100 (CET)
On Mon, 21 Nov 2005, Matt Pickering wrote:

> Hello,
>
> Hopefully someone can help with this -
>
> I put an ethereal monitor on my network that is running between an
> Oracle 9i database and a Weblogic 8.1 front end webserver, all of which
> are running on Solaris 9.  When I ran the capture, I am seeing an
> enormous amount of retransmission packets.  When I look at the
> tracefile, almost every packet seems to have a request, and then
> miliseconds later, a retransmission.  For instance, I have a packet
> capture that has approximately 80,000 packets, and 40,000 of those
> packets are marked as "retransmissions".  When I look at the TCP
> Analysis Flags, it indicates that "This frame is a (suspected)
> retransmission).  I apologize, but I'm not sure what information I need
> to pass on to be helpful - please advise what sort of infomation would
> be necessary to troubleshoot this problem, and how I can pass this info
> along - I would be willing to send a sample capture, but I'm not sure if
> that's allowed on this list.
>
> If anyone has an idea on this, I would greatly appreciate it.
>
> Thanks,
> Matt

Hi Matt,

editcap -r <yourcapturefile> <samplecapturefile> 1-50

and send the <samplecapturefile> to the list or make it available
somewhere. We'll go from there.

Good luck,
Jaap