Wireshark-users: [Wireshark-users] Dropped apckets/TCP Connection Loss

From: "Adam Mattina" <amattina@xxxxxxxxxxxxxxx>
Date: Wed, 23 Aug 2006 10:37:06 -0400

I'm posting this in this group because I believe that this problem
could have something to do with TCP connections not working properly
via our provider. If you have any ideas I would greatly appreciate it.

I am still using ‘Ethereal’ at this point. Just found out about the name

change today so I guess I’ll be switching over to WS soon.


Cisco 2811 ISR on 4mbit metro ethernet.
~200 users

Web pages are coming up either
a) perfectly
b) half mangled with some images and screwed up tables or
c) not at all

There is no pattern as to when or why a page might not come up. Most of
this happens at lunchtime while people sit at their desks and browse.
More usage = more of this problem. Tried cranking up the bandwidth to
10mbit and still had the same problem.

This is what a webpage might look like:

This is what the capture looks like:

I realize that retransmissions are normal, and this is what a normal
loss/retransmit should look like(taken from my home and office

Notice the 'Continuation packets' in the good packet loss image. I
don't get those on the problem network.

I've troubleshot this down to the ISR and provider uplink.  The
provider from their NOC said that everythign on the line looked good
and we don't have a ton of dropped packets on the ISR which one might
expect. Any ideas? I've been working on this for weeks.




Adam Mattina
Networking & Systems Support
Layer 8 Group, Inc.