It may be an application issue as well, but you are wise to eliminate
the physical layer first.
If you think it is a NIC or even a patch cable problem (in that
packets are being sent or received with errors), you should see error
stats either on the switch or the PC interface counters. Do you want
to send a subset of your capture file showing the problem to the list?
Regards, Martin
Regards, Martin
MartinVisser99@xxxxxxxxx
On Tue, Apr 28, 2009 at 4:40 AM, Aaron Evans
<aaronevans@xxxxxxxxxxxxxxxxx> wrote:
> I'm trying to track down what is eating up all of my bandwidth. I'm using
> cacti to monitor network traffic and found a server that for a lack of
> better description hemorrhaging data. I've got hp procurve 5406zl's that
> I'm using to mirror traffic to my sniffer machine and blocking all other
> switch traffic to the sniffer port. Over the course of a twenty second
> capture (27,000~ packets), roughly 35% of my traffic is the [TCP ACKed lost
> segment] afpovertcp > 49278. Any advice on this is welcome. I suspect I
> have a failing NIC on my server but would like some expert opinions before
> ordering a new system board. Thanks in advance
> --
> Aaron Evans
> Network Support Specialist
> USD 491
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
