Wireshark-users: Re: [Wireshark-users] Help with troubleshooting SQL and application server commu

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Tue, 12 Aug 2008 23:14:20 -0400
Michael Montgomery wrote:

| That being said, is it possible to post an extract of the capture ? Yes, I can post or email you an extract of the capture. I'm just not sure how to post it on this forum and what information I should remove. Do I just attach an export to the email or is there an upload feature?

If there's no concern about keeping information in the file private and if you can extract a relatively small (say < 200K) but relevant portion from one of the large files then you can attach it to an EMail to the list. (zip or gzip can be used to reduce the size of the attachment).

Otherwise I suggest that you extract a relevant portion and send the file as an Email (g)zipped attachment directly to me (wmeier at newsguy dot com).


Lastly some statistics on an average capture. Approx. 1 minute, 100 MB capture file, 107915 frames, 36478 out-of-order warnings and 16813 DUP Ack notes.

On which node are you taking the capture ?

One-third of the frames being out-of-order with that many DUP-ACKS seems excessive. Are there many retransmissions indicated in the capture ?

If so, I would suggest that a network person should examine your network configuration and etc to determine what's going on.