Thanks.
Replies below.
-- "Alok" <alokdube@xxxxxxxxxx> wrote:
----- Original Message -----
Sent: Monday, September 12, 2005 7:55 PM
Subject: [Ethereal-users] TCP Retransmissions and resets: What is an"acceptable" rate of occur rence?
I am wondering what is an acceptable rate of occurrence for TCP retransmissions and resets.
Let's say you open up capture of 10 minutes of Internet traffic for a small office LAN with 10 users and one switch/router/firewall, and you see retransmissions.
==>Alok: Even more predominant on tunneled setups
You examine a few of the connections closely for retransmissions and resets, and you don't see very many per connection, and you don't see the connection closing because of too many retransmissions. You just occasionally see one frame not get an acknowledgment quickly enough, and a single retransmission is sent because of a time out. Or occasionally, a connection is just closed with a reset, and you don't know if the user simply closed their browser in the middle of loading a page.
==>Alok: see if there is another session after the RST with the same peer?
====>Gunndo: Good idea.
If you total the number of TCP frames per connection, and figure the retransmissions/resets rate per frame, you could get <1%, or 5%, or 10%.
==> Alok: is it per frame? or per connection? do you mean 10% of your traffic is retransmissions? good! what is it ? a wireless/VSAT link?
====>Gunndo: Total connection retransmissions/Total TCP frames per connection over DSL, cable, or T1 Internet connection. No wireless of VSAT. Typically I see this running less than 1%, but what if it is higher? Is 10-30% only acceptable in wireless?
One recent capture had 300 total retransmissions for one user, but the number of frames for this user was 21.531, for a rate of 1.39%. Do I ignore this as a normal occurrence?.
=> Alok: What do you meanby "rate" here?
====>Gunndo: Total number of retransmitted frames for a given LAN IP divided by total number of TCP frames for a given LAN IP. Make the example read 300/21531, not 300/21.531.
I expect some retransmissions/resets to be a "normal" event, but at what rate do you begin to be concerned?
Isn't some low rate such as 2% actually "normal" for an Internet connection?
Do you know a source for what is generally accepted to be a "normal" for TCP traffic?
And what if the traffic is for a small LAN, rather than for an Internet connection? What rate is acceptable for a LAN?
Doug (Gunndo)
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users