Wireshark-users: Re: [Wireshark-users] TCP retransmit, HTTP and web page not loading
On Wed, Jun 25, 2008 at 09:19:46AM -0400, Steve Bertrand wrote:
>
> I run tcpdump (saved to a Wireshark compatible output file) on my VLAN
> switch at my end prior to going to the client end over the fibre. I can
> see the communication from workstation to the site and vise-versa, and
> it *appears* as though all is well.
>
> The only difference between what I see on ADSL and fibre is the numerous
> 'TCP Retransmission' errors for one particular GET command on the fibre.
> I have two questions (I am not hugely familiar in the frame level
> aspects of network communication. I am more in the business of routing
> the packets).
>
> There is a screen cap of the final communication between the server and
> client if anyone could possibly have a look if they can answer my questions.
>
> http://ibctech.ca/screencap/fibre_communication.jpg
Please provide the (binary) capture file instead of a screendump. We love
using wireshark instead of an image-viewer ;-)
> A) Will a TCP session finish successfully even if some frames could not
> be ultimately received?
Nope, TCP keeps state information on it's connection and tries to
recover from missed data and also when data has not been acknowledged.
> B) From what I have in the screencap without the frames expanded, is it
> safe to assume that the file mentioned in the retransmission message did
> not get transferred?
Well, since it's not obviously visible in the screendump which
http-response is to which http-request (there is no column with
port numbers), one can not really tell.
The retransmissions suggest that either:
(if there is no response in the tracefile)
- the get request never arives at the server after passing your
capturing system
- the response from the server gets lost on the way between the server
and your capturing system
(if there is indeed a response in the tracefile)
- the response gets lost between your capturing system and the
client PC
> Symptoms are the Title of the site appears in the browser, it spins it's
> wheels, then stops.
Taken that this particular object never makes it to the client, this is
to be expected as the object is a cascading stylesheet, which would be
necessary to format the html-code on the screen. When it's missing, the
browser can not show the data it has already received.
Please upload the binary capture so we can have a closer look at
where the data might be missing.
Next steps would be to start a capture on both ends of the fibre to see
where there's a difference between the two captures. Is the ethernet
data tunneled somehow by the fibre-provider?
Cheers,
Sake
