TCP retransmit frames

[paulk29]

Guys,
we're having issues on our Network. I did a sniff of the LAN and captured 256Mb worth of data. I can see alot of TCP frame retransmissions. Is there a way to set up a filter so that all that is displayed are the retransmitted TCP frames?

Any help is greatly appreciated.

Thanks

Paul

Paul Kilcoyne B eng. CCNA

 

[febod]

No. TCP Retransmits is not a packet type that a display filter can be applied for, but an analysis of retransmitted packets. What you want to do is first make sure that your duplicate packets are not because of the span on your switch, so do a single ping and make sure you see a single icmp request and reply. If you do, then you have network issues on low bandwidth conversations or network issues/host buffer issues on large throughput conversations.

 

[febod]

One other note, applications that do tcp keepalives always show up as a retrans the first time the sniffer decodes it, and depending on whether the keepalives have a 1 byte data packet or not, it could decode them as retransmits also.


good luck