Wireshark-users: Re: [Wireshark-users] newbie question

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Tony Manetta <amanetta@xxxxxxxxx>
Date: Thu, 25 Feb 2010 16:54:56 -0500
lets try that again...here are the frames
No. Time Source Destination Protocol Info 248 14.550042 192.168.1.44 24.92.226.11 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] 

Frame 248 (1078 bytes on wire, 1078 bytes captured)
Ethernet II, Src: Sony_d9:95:99 (00:1a:80:d9:95:99), Dst: Cisco_d0:4f:11 (00:24:14:d0:4f:11) Internet Protocol, Src: 192.168.1.44 (192.168.1.44), Dst: 24.92.226.11 (24.92.226.11) Transmission Control Protocol, Src Port: 50748 (50748), Dst Port: http (80), Seq: 190, Ack: 26, Len: 1024 
    Source port: 50748 (50748)
    Destination port: http (80)
    [Stream index: 8]
    Sequence number: 190    (relative sequence number)
    [Next sequence number: 1214    (relative sequence number)]
    Acknowledgement number: 26    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 16688
    Checksum: 0x4ef6 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 1024]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 0.294203000 seconds]
            [RTO based on delta from frame: 246]
    [Reassembled PDU in frame: 246]
    TCP segment data (1024 bytes)
No. Time Source Destination Protocol Info 249 14.550713 24.92.226.11 192.168.1.44 HTTP [TCP Retransmission] HTTP/1.1 100 Continue 

Frame 249 (79 bytes on wire, 79 bytes captured)
Ethernet II, Src: Cisco_d0:4f:11 (00:24:14:d0:4f:11), Dst: Sony_d9:95:99 (00:1a:80:d9:95:99) Internet Protocol, Src: 24.92.226.11 (24.92.226.11), Dst: 192.168.1.44 (192.168.1.44) Transmission Control Protocol, Src Port: http (80), Dst Port: 50748 (50748), Seq: 1, Ack: 190, Len: 25 
    Source port: http (80)
    Destination port: 50748 (50748)
    [Stream index: 8]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 26    (relative sequence number)]
    Acknowledgement number: 190    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 260
    Checksum: 0x53fb [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 25]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 0.294992000 seconds]
            [RTO based on delta from frame: 245]
Hypertext Transfer Protocol
    HTTP/1.1 100 Continue\r\n
        [Expert Info (Chat/Sequence): HTTP/1.1 100 Continue\r\n]
            [Message: HTTP/1.1 100 Continue\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Response Code: 100
    \r\n
No. Time Source Destination Protocol Info 250 14.550738 192.168.1.44 24.92.226.11 TCP [TCP Dup ACK 248#1] 50748 > http [ACK] Seq=1214 Ack=26 Win=16688 Len=0 SLE=1 SRE=26 

Frame 250 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: Sony_d9:95:99 (00:1a:80:d9:95:99), Dst: Cisco_d0:4f:11 (00:24:14:d0:4f:11) Internet Protocol, Src: 192.168.1.44 (192.168.1.44), Dst: 24.92.226.11 (24.92.226.11) Transmission Control Protocol, Src Port: 50748 (50748), Dst Port: http (80), Seq: 1214, Ack: 26, Len: 0 
    Source port: 50748 (50748)
    Destination port: http (80)
    [Stream index: 8]
    Sequence number: 1214    (relative sequence number)
    Acknowledgement number: 26    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
    Window size: 16688
    Checksum: 0x1126 [validation disabled]
    Options: (12 bytes)
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 249]
        [The RTT to ACK the segment was: 0.000025000 seconds]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 248]
            [Expert Info (Note/Sequence): Duplicate ACK (#1)]
                [Message: Duplicate ACK (#1)]
                [Severity level: Note]
                [Group: Sequence]
__________________________________________________________________

Tony Manetta, MBA, MCP
Supervisor of Networking Technology and Services
UDSMR
716-817-7850 (office)
716-479-6258 (mobile)

On 2/25/2010 4:54 PM, Tony Manetta wrote:

Hi
just tried using wireshark to see if a network issue is causing sever slowness when logging into a web server....i'm having issues understanding the output of the trace...can anyone help? when i login locally, the login time is approximately 4 seconds but when i login across the web, it's over 25 seconds which is unacceptable. if this isnt appropriate use of this list, i apologize in advance....below are 3 frames which first start showing up as issues in my capture...any ideas are greatly appreciated....