Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] TCP out of order segments

From: Steven Ryder <sryder@xxxxxxxxxxxxxxxxxxxxxxx>
Date: Mon, 2 Jul 2012 16:20:32 -0700

I was doing some searching about Out of Order packets and came across this thread that was apparently posted to this list. I didn’t see any real answer to it so I’m posting my findings. I hope this is not too old :-/ .

 

http://www.wireshark.org/lists/wireshark-users/200701/msg00060.html

 

I can tell you I found the cause of this in my case. I have a Cisco 6509 connected to a Cisco 3560 on a gig port. I saw significant Output drops on the 6509 end because the buffers in a 3560 cannot keep up with what a 6509 can push. I did a packet capture and found I am getting 100Mbps in Out of Order packets…yuck. The 3560’s are not a data center class switch and we should not be using them in our case.

 

The 1st 24 ports of the 3560 all share a 2MB buffer, the 2nd 24 ports share another 2MB buffer. That’s not much at all.

 

Contrast that with the 6509’s (using WS-X6748’s) and they have a 1.3MB buffer per port and you can clearly see the 3560 cannot keep up.

 

All Gig ports are not created equally :-/.

 

Anyway, I hope this helps.

 

Thank you,

-Steve