Answers to: Retransmissions<p>I get hundreds of these when i copy from my windows 2003 server at one site to a windows 2008 r2 server at another. Any idea on what's going on or how to troubleshoot it?</p> <pre><code>10193 0.000000000 TCP 1514 [TCP Fast Retransmission] [TCP segment of a reassembled PDU] 10203 0.003003000 TCP 1514 [TCP Retransmission] [TCP segment of a reassembled PDU] </code></pre> <p>Its also at <a href=""></a> </p>enThu, 17 Jan 2013 03:55:30 -0800Answer by packethunter<p>Assuming that you refer to "[TCP Retransmission]" that usually indicates trouble - or at least potential trouble.</p> <p>Most file copy programs rely on TCP to facilitate the data transfer. The receiver acknowledges received data. If a packet is lost for any reason it is retransmitted by the sender.</p> <p>Wireshark usually does a good job in detecting the retransmission and marks those packets.</p> <p>An occasional retransmission is not a big matter. However, an excessive number of retransmissions (like "hundreds") will significantly increase the time for the file transfer and annoy the user.</p> <p>Packets get lost for any number of reasons. Here are a few likely candidates for large number of retransmissions:</p> <ul> <li>Full Duplex / Half Duplex mismatch (check the configuration of the network card and switch interfaces)</li> <li>The server transmits data with a high speed (say 1 GBit) and the receiver is connected with a lower speed (say 100 MBit). Drops occur if the receiver is signalling a large TCP window size, found in the TCP header.</li> <li>One of your routers is configured with a quality of service rule that enforces a certain the bandwidth</li> <li>A broken cable offers very poor signal quality</li> <li>A wireless network is busy or suffers from interference</li> </ul> <p>The second reason is often observed when Windows Vista / Win 7 pulls data from a Server 2008.</p> <p>Good hunting!</p>packethunterThu, 17 Jan 2013 03:55:30 -0800 by SYN-bit<p>Assuming you refer to the "[TCP segment of a reassembled PDU]" messages when saying "I get hundreds of these", these are perfectly normal messages. Wireshark re-assembles higher layer protocol PDU's. This means multiple packets that belong together will be shown as one appliaction message. Have a look at frame 1849, it says:</p> <pre><code>24 Reassembled TCP Segments (32831 bytes): #1815(304), #1818(1460), #1819(1460), #1820(1460), #1822(1460), #1823(1460), #1825(1460), #1826(1460), #1827(1460), #1829(1460), #1830(1460), #1832(1460), #1833(1460), #1835(1460), #1836(1460), etc. </code></pre> <p>This means the SMB PDU "Read AndX Response, FID: 0x4017, 32768 bytes" was split over 24 packets (which is logical as the payload part of that PDU alone is 32768).</p> <p>More info on <a href=""></a></p>SYN-bitThu, 17 Jan 2013 00:34:31 -0800