Wireshark · Wireshark-users: Re: [Wireshark-users] Retransmission because of no ACK from user

[vincent paul <amoteluro@xxxxxxxxx>]

Thank you for the response.  user did receive the packet twice.  This is the reason why wireshark label the second packet as retransmission.

regards,

---

From: Andrew Hood <ajhood@xxxxxxxxx>
To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
Sent: Sun, January 16, 2011 3:27:24 AM
Subject: Re: [Wireshark-users] Retransmission because of no ACK from user

vincent paul wrote:
> Hi All,
>
> I am looking at one trace with retransmissions from server because user's side
> did not send ACK for packets it received from server.  Is there any reason why
> user's side does not send out ACK.

Do you know the client did receive the data or is that an assumption?

What is between the server and the client?

Can you sniff the traffic at intermediate points?

Do you see the session setup packets (SYN, SYN+ACK, ACK) and then when
the data starts, the ACKs stop?

This could be the classic "firewall dropping ICMP frag required packets"
behaviour.

Can you reduce the MTU at the server? In Windows you have to reduce it
with a registry setting and that affects all interfaces and requires a
reboot. Unixish systems let you set the MTU on route commands.

If there is any ADSL involved, 1492 is a likely value for the MTU. 1460
is the next most likely value.

Andrew
--
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe