Wireshark-users: Re: [Wireshark-users] [TCP Previous segment lost], TCP [TCP Dup ACK 125#1], RTMP [TCP Retransmission]

From: Jeffrey Walton <noloader@xxxxxxxxx>
Date: Mon, 7 Sep 2009 12:25:05 -0400

Hi Nikolai,

Using ip.host == "s3.amazonaws.com". The three way handshake appears
to be missing, but take a look at some of your window sizes: 90, 97,
98. They seem to occur early, and they are a result of HTTP
fetches/requests. Later you experience out of order packets and packet
loss.

I've seen this before, but I'm not sure I reached the right
conclusion. In my case, an IT guy was on the other end, who verified
his equipment settings. I spent a little time trying to FTP bulk data
between my site and a University that had a similar geoip while
running pings and tracerts. But I was not convinced the data was
passing through the same equipment.

I had to write it off to equipment in the network out of our control.
Some time later, we had Verizon on site. They performed a BERT and
found the line to be noisy. Outside Plant worked their magic, and I
have not observed the issue since then.

Jeff

On Mon, Sep 7, 2009 at 6:37 AM, Nikolai
Longolius<longolius@xxxxxxxxxxxxxx> wrote:
> Hello everyone,
>
> we're in trouble with our website and a german ISP (Hansenet) where it seems
> that we've got a lot of packet loss. I got some users to use wireshark to
> capture packets and the dominating colour is red.
> Could someone on this list tell me if the problem here is packet loss?
> Our Servers are Amazon AWS EC2 instances in the US running Wowza Flash
> Streaming Server. When using any other ISP than Hansenet (which is No 3 in
> Germany) the problem doesn't occur.
> I raised errors on the ISP side and on AWS side - but as you can imagine
> nobody realy feels responsible.
>
> I attached the dumpfile.
>
> Any help or comment is appreciated.
>
> Thank you for your time!
>
> Regards,
> Nikolai
> --
> Nikolai Longolius
> schnee von morgen webTV GmbH
>
> Manteuffelstr 66
> 10999 Berlin
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>