Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] TCP retransmit, HTTP and web page not loading

From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 25 Jun 2008 16:06:02 +0200
On Wed, Jun 25, 2008 at 09:19:46AM -0400, Steve Bertrand wrote:
> 
> I run tcpdump (saved to a Wireshark compatible output file) on my VLAN 
> switch at my end prior to going to the client end over the fibre. I can 
> see the communication from workstation to the site and vise-versa, and 
> it *appears* as though all is well.
> 
> The only difference between what I see on ADSL and fibre is the numerous 
> 'TCP Retransmission' errors for one particular GET command on the fibre. 
> I have two questions (I am not hugely familiar in the frame level 
> aspects of network communication. I am more in the business of routing 
> the packets).
> 
> There is a screen cap of the final communication between the server and 
> client if anyone could possibly have a look if they can answer my questions.
> 
> http://ibctech.ca/screencap/fibre_communication.jpg

Please provide the (binary) capture file instead of a screendump. We love
using wireshark instead of an image-viewer ;-)

> A) Will a TCP session finish successfully even if some frames could not 
> be ultimately received?

Nope, TCP keeps state information on it's connection and tries to
recover from missed data and also when data has not been acknowledged.
 
> B) From what I have in the screencap without the frames expanded, is it 
> safe to assume that the file mentioned in the retransmission message did 
> not get transferred?

Well, since it's not obviously visible in the screendump which
http-response is to which http-request (there is no column with
port numbers), one can not really tell.

The retransmissions suggest that either:

(if there is no response in the tracefile)
- the get request never arives at the server after passing your
  capturing system
- the response from the server gets lost on the way between the server
  and your capturing system

(if there is indeed a response in the tracefile)
- the response gets lost between your capturing system and the
  client PC

> Symptoms are the Title of the site appears in the browser, it spins it's 
> wheels, then stops.

Taken that this particular object never makes it to the client, this is
to be expected as the object is a cascading stylesheet, which would be 
necessary to format the html-code on the screen. When it's missing, the
browser can not show the data it has already received.

Please upload the binary capture so we can have a closer look at
where the data might be missing.

Next steps would be to start a capture on both ends of the fibre to see 
where there's a difference between the two captures. Is the ethernet
data tunneled somehow by the fibre-provider?

Cheers,
    Sake