Wireshark shows lots of TCP retransmissions. How do you work out where the loss is?
Show the answer
Say this first
A retransmission means the sender believed a segment was lost. I check which side retransmits and what else Wireshark flags: duplicate ACKs, "previous segment not captured". Then I capture at both ends. If the original left the sender and never reached the receiver, the loss is in between, and I narrow it with capture points and interface counters along the path. If it arrived, the ACK was lost on the way back, or the capture point itself missed it.
Go deeper
Wireshark labels
| Label | Meaning |
|---|---|
[TCP Retransmission] | sent again after the retransmission timer expired |
[TCP Fast Retransmission] | sent again after 3 duplicate ACKs, without waiting for the timer |
[TCP Dup ACK 21#3] | the third duplicate of the ACK in frame 21: the receiver is missing a segment |
[TCP Previous segment not captured] | a gap in sequence numbers, lost in the network or by the capture |
[TCP Spurious Retransmission] | resent data the receiver had already acknowledged |
[TCP Out-Of-Order] | arrived with a lower sequence number than expected |
Locating the loss
- A capture on the sender proves the original left. A capture on the receiver proves whether it arrived.
- Match the same segment in both files by sequence number or IP ID.
- Lost in between: walk the path. CRC errors on receiving interfaces, output drops on egress ports,
policer drops in
show policy-map interface. - Arrived but no ACK came back: look at the return path, which may be a different path.
Read the pattern
| Pattern | Likely cause |
|---|---|
| Steady loss at any load | a link with errors |
| Bursts of loss at high throughput | congestion or a policer |
| Only full-size segments lost | MTU |
Why a little loss hurts
Single-flow TCP throughput falls roughly with the square root of the loss rate (the Mathis estimate). On a 50 ms path, 1 percent loss can hold one flow to a few Mb/s whatever the link speed.
They will ask next
How do you tell congestion loss from a bad link?
Congestion loss comes in bursts when throughput is high and lines up with output or policer drops on some device. Link errors happen at any load and line up with CRC or input errors on a receiving port.
What is the difference between a retransmission and a fast retransmission?
A timer-based retransmission waits for the RTO, which RFC 6298 starts at 1 second and doubles on each timeout. A fast retransmission is triggered by 3 duplicate ACKs, usually within one round trip, and costs far less time.
Traps
- Blaming the network for spurious retransmissions caused by a slow receiver or a capture point that dropped packets.