06-19, 10:15–11:15 (America/New_York), Great Falls
Some packet loss is expected, but how do you define "some"? This talk examines the characteristics of expected loss due to signal interference or router queue drops, versus excessive retransmissions indicating deeper issues.
- Practice with a "normal" TCP stream which has slight packet loss. How long should it take, and what are those darn Dup ACK's?
- Identifying the source of excessive retransmissions - your network or theirs?
- Retransmissions of specific packet types within TCP streams. Is it always or only sometimes?
- High retransmission counts in a pcap captured within a building, yet the switches and routers report no errors. What could cause that?
By analyzing real-world examples, you'll gain a detailed understanding of TCP retransmission patterns, learn to distinguish "normal" from "excessive", and troubleshoot accordingly.
Bring your laptops! This talk will be an interactive analysis of anonymized pcap files from real client cases. Walk away with insights to pinpoint the root cause of packet loss and the accompanying slowdowns.
Please download my TCP profile from https://gitlab.com/WiresharkProfiles/profiles and add it to your Wireshark. How to instructions are on the page. Thanks!
Betty DuBois unlocks the power of packets to resolve NetOps and SecOps issues. Founder of Packet Detectives, an application & network performance consulting and training firm the Washington, D.C area. She has been solving packet mysteries since 1997.
Experienced with a range of hardware and software packet capture solutions, she captures the right data, in the right place, and at the right time to find the real culprit.
Using packets to solve crimes against networks and applications is her passion. Teaching others to do the same is her calling.