Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: Re: [Wireshark-users] Duplicate ACK

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: Abhik Sarkar <sarkar.abhik@xxxxxxxxx>
Date: Wed, 4 Mar 2009 13:31:31 +0400

Hi Edward,

Though it might not apply to your case, perhaps you want to have a look at this:
http://www.wireshark.org/lists/wireshark-users/200901/msg00032.html

I have seen the same behavior if the system uses bonded interfaces and the interface "any" is used for capturing (assuming Linux is used).

If this does apply, then you can simply use "editcap -d" on the capture file to get rid of the duplicate acks.

HTH
Abhik.

On Wed, Mar 4, 2009 at 12:17 AM, EDWARD HILL <EHill@xxxxxxxxx> wrote:
 
I took a capture on my network between the firewall and the app server. I have been seeing a lot of duplicate acks. But the duplicate acks never go past one and they are always from the firewall. It seems like the firewall is just trying to catch up to its buffer. I never see fast retransmissions or retransmissions. How many duplicate acks in a period of time is to much?
 
Ed

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

  • Follow-Ups:
    • Re: [Wireshark-users] Duplicate ACK
      • From: EDWARD HILL
  • References:
    • [Wireshark-users] Duplicate ACK
      • From: EDWARD HILL
  • Prev by Date: Re: [Wireshark-users] Can't get static URL for this radio station
  • Next by Date: Re: [Wireshark-users] TCP checksum off-by-one errors?
  • Previous by thread: [Wireshark-users] Duplicate ACK
  • Next by thread: Re: [Wireshark-users] Duplicate ACK
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation