Wireshark mailing list archives
Strange TCP behavior after packet loss - 1 packet at a time despite large window, 5 sec delay
From: Shawn T Carroll <shawnthomascarroll () yahoo com>
Date: Thu, 21 Apr 2016 15:47:30 +0000 (UTC)
Looking for any TCP experts to help explain this! We are troubleshooting a slowness issue involving traffic through a load balancer, and we have found a smoking gun where a 9k file is being transferred, hits some packet loss, but then after what looks like successful retransmission, see what appears to be the load balancer sending 1 packet at a time, after waiting about 5 sec each packet. The result is that it takes 35 sec to transfer a 9k file (7 packets * 5 sec). In the attached capture, you see:1. normal TCP behavior, and the lb attempting to transfer the file to the client (frames 15-22)2. some packet loss; the client ACKS for frame 15, about 7 packets back3. a pattern of: client ACKs for the lb to retransmit some data lb ACKs that request lb waits 5 sec lb transmits the requested data (this pattern in frames 28-41) I am confused, because: the window size is fine (66640) yet the load balancer is transmitting only one packet before waiting for an ACK the lb waits 5 sec (an eternity) and never speeds up upon subsequent quick ACKs from the client Can anyone explain what is going on here?What are the possible mechanisms in modern TCP that *should*, after some packet loss, be reducing the # packets sent, and/or increasing the time between sent packets?Could one of these be going haywire?Anyone seen something like this? The lb is a NetScaler. Thanks! :-) Shawn
Attachment:
LB nstrace1-6-stream8only.cap
Description:
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Strange TCP behavior after packet loss - 1 packet at a time despite large window, 5 sec delay Shawn T Carroll (Apr 21)