TCP retransmits

I've got a couple systems in a data center that talk to a couple other systems
in another location. This works fine except that we're getting daily
disconnects between the two devices and running "netstat -s" on the first two
show extremely high TCP segment retransmissions. Perfmon also shows this. But
other network tools like Ethereal show no retransmits taking place, and the
bandwidth on the circuit has not increased. So it appears that there are no
NACK packets being generated.

Anyone know why netstat would show high retransmissions when there are no such
packets on the network?

In news:(E-Mail Removed),
Mike Lowery <(E-Mail Removed)> stated, which I commented on below:
> I've got a couple systems in a data center that talk to a couple
> other systems in another location. This works fine except that we're
> getting daily disconnects between the two devices and running
> "netstat -s" on the first two show extremely high TCP segment
> retransmissions. Perfmon also shows this. But other network tools
> like Ethereal show no retransmits taking place, and the bandwidth on
> the circuit has not increased. So it appears that there are no NACK
> packets being generated.
> Anyone know why netstat would show high retransmissions when there
> are no such packets on the network?

I know this may sound too simple, but have you checked the network
connections (plugs, wires, etc) or even the port on the switch for any
issues? A simple bad plug will do it. From what you're describing, if
there's an issue with any of the above I mentioned. Siomple wiring issues
can cause 95% of unknow unusual issues.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.

It's easy:
How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only thing in life is change. Anything more is a blackhole consuming
unnecessary energy. - [Me]

You might want to check the NIC properties for auto-sense, 100/full,
etcetera, and see if anything changes when you change the setting.

-Frank

"Mike Lowery" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I've got a couple systems in a data center that talk to a couple other
> systems in another location. This works fine except that we're getting
> daily disconnects between the two devices and running "netstat -s" on the
> first two show extremely high TCP segment retransmissions. Perfmon also
> shows this. But other network tools like Ethereal show no retransmits
> taking place, and the bandwidth on the circuit has not increased. So it
> appears that there are no NACK packets being generated.
>
> Anyone know why netstat would show high retransmissions when there are no
> such packets on the network?
>
>

"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> In news:(E-Mail Removed),
> Mike Lowery <(E-Mail Removed)> stated, which I commented on below:
>> I've got a couple systems in a data center that talk to a couple
>> other systems in another location. This works fine except that we're
>> getting daily disconnects between the two devices and running
>> "netstat -s" on the first two show extremely high TCP segment
>> retransmissions. Perfmon also shows this. But other network tools
>> like Ethereal show no retransmits taking place, and the bandwidth on
>> the circuit has not increased. So it appears that there are no NACK
>> packets being generated.
>> Anyone know why netstat would show high retransmissions when there
>> are no such packets on the network?
>
> I know this may sound too simple, but have you checked the network connections
> (plugs, wires, etc) or even the port on the switch for any issues? A simple
> bad plug will do it. From what you're describing, if there's an issue with any
> of the above I mentioned. Siomple wiring issues can cause 95% of unknow
> unusual issues.

Our networking guy hasn't noticed any errors or retransmits on the network
devices so he doesn't think it's a network problem at this point. The fact that
it's happening on two boxes seems to imply that it's not an issue with the PC
itself, but either something downstream or a software issue.

The software is Windows Media Encoder connecting to a Windows Media Server at a
remote location.

In news:uo1mcU$(E-Mail Removed),
Mike Lowery <(E-Mail Removed)> stated, which I commented on below:

> Our networking guy hasn't noticed any errors or retransmits on the
> network devices so he doesn't think it's a network problem at this
> point. The fact that it's happening on two boxes seems to imply that
> it's not an issue with the PC itself, but either something downstream
> or a software issue.
> The software is Windows Media Encoder connecting to a Windows Media
> Server at a remote location.

Unfortunately I've not used Media Encoder. I would suggest to check Google
or www.technet.com for any issues with misconfigurations that may cause
this.

Ace

"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> In news:uo1mcU$(E-Mail Removed),
> Mike Lowery <(E-Mail Removed)> stated, which I commented on below:
>
>> Our networking guy hasn't noticed any errors or retransmits on the
>> network devices so he doesn't think it's a network problem at this
>> point. The fact that it's happening on two boxes seems to imply that
>> it's not an issue with the PC itself, but either something downstream
>> or a software issue.
>> The software is Windows Media Encoder connecting to a Windows Media
>> Server at a remote location.
>
> Unfortunately I've not used Media Encoder. I would suggest to check Google or
> www.technet.com for any issues with misconfigurations that may cause this.

After posting that last message I realized that it doesn't matter what the
software is. Netstat is still showing errors which happens at a lower level
than the application layer.

In news:(E-Mail Removed),
Mike Lowery <(E-Mail Removed)> stated, which I commented on below:
> After posting that last message I realized that it doesn't matter
> what the software is. Netstat is still showing errors which happens
> at a lower level than the application layer.

Sorry, Mike. Other than what Frankster or I posted, I can't think of
anything else, unless back to simple issues, such as wiring, or even a
firewall blocking traffic and the system is trying to retransmit to
establish a connection. Maybe it can also be an SMB signing issue, but I
kind of doubt that at this point.

Ace

"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> In news:(E-Mail Removed),
> Mike Lowery <(E-Mail Removed)> stated, which I commented on below:
>> After posting that last message I realized that it doesn't matter
>> what the software is. Netstat is still showing errors which happens
>> at a lower level than the application layer.
>
> Sorry, Mike. Other than what Frankster or I posted, I can't think of anything
> else, unless back to simple issues, such as wiring, or even a firewall
> blocking traffic and the system is trying to retransmit to establish a
> connection. Maybe it can also be an SMB signing issue, but I kind of doubt
> that at this point.

We already checked the duplex settings/etc. and everything looks good. None of
the network monitoring tools show anything unusual. But netstat does and our
app disconnects several times a day. And this happens on two different PCs in
this same LAN.

Sure sounds like a network issue to me, just one that's hard to locate. And
unfortunately these PCs reside in another country far, far away!

In news:(E-Mail Removed),
Mike Lowery <(E-Mail Removed)> stated, which I commented on below:

> We already checked the duplex settings/etc. and everything looks
> good. None of the network monitoring tools show anything unusual. But
> netstat does and our app disconnects several times a day. And
> this happens on two different PCs in this same LAN.
>
> Sure sounds like a network issue to me, just one that's hard to
> locate. And unfortunately these PCs reside in another country far,
> far away!

Maybe it's time to run some performance logging (for the NIC, apps and
services running) on those PCs. This way you can coorelate when the
retransmits occur and what app or entitiy is doing it. May I assume there's
no Event ID errors on those PCs?

Ace

"Ace Fekay [MVP]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> In news:(E-Mail Removed),
> Mike Lowery <(E-Mail Removed)> stated, which I commented on below:
>
>> We already checked the duplex settings/etc. and everything looks
>> good. None of the network monitoring tools show anything unusual. But
>> netstat does and our app disconnects several times a day. And
>> this happens on two different PCs in this same LAN.
>>
>> Sure sounds like a network issue to me, just one that's hard to
>> locate. And unfortunately these PCs reside in another country far,
>> far away!
>
> Maybe it's time to run some performance logging (for the NIC, apps and
> services running) on those PCs. This way you can coorelate when the
> retransmits occur and what app or entitiy is doing it. May I assume there's no
> Event ID errors on those PCs?

Since this a box running Windows Media Encoder streaming a ~500Kbps video, the
network errors are continuous. Actually, Windows claims there's a retransmit
for every packet sent (but network monitoring shows no increase in bandwidth)!

There are no errors in the Event Logs.