[Abhik Sarkar <sarkar.abhik@xxxxxxxxx>]

Hi Edward,

Though it might not apply to your case, perhaps you want to have a look at this:
http://www.wireshark.org/lists/wireshark-users/200901/msg00032.html

I have seen the same behavior if the system uses bonded interfaces and the interface "any" is used for capturing (assuming Linux is used).

If this does apply, then you can simply use "editcap -d" on the capture file to get rid of the duplicate acks.

HTH
Abhik.

On Wed, Mar 4, 2009 at 12:17 AM, EDWARD HILL <EHill@xxxxxxxxx> wrote:

 

I took a capture on my network between the firewall and the app server. I have been seeing a lot of duplicate acks. But the duplicate acks never go past one and they are always from the firewall. It seems like the firewall is just trying to catch up to its buffer. I never see fast retransmissions or retransmissions. How many duplicate acks in a period of time is to much?

 

Ed

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe