Phil Storey

Troubleshoot complex network and application performance problems - mostly via packet capture and deep analysis with a tools like NetData, Wireshark, NetScout.

[Phil Storey @PhilStorey24]

@TheVeryVery @wholemars That’s exactly me too. Just done about 2400 miles in 3 weeks (via a Turo rental) and I only drove about 30 (for fun on twisty mountain roads).

[Phil Storey @PhilStorey24]

@OfficialABQ Why not just re-enable “real intelligence” and change the rules to allow people to drive through them when it’s safe to do so. That is, redefine a red light as the same as a stop sign (which we already accept human intelligence as being able to make the proper decisions).

[Phil Storey @PhilStorey24]

@crnetpackets Thanks Christian, good to "see" you.

[Phil Storey @PhilStorey24]

@PacketJay @Profitap Appreciate that Jasper!

[Phil Storey @PhilStorey24]

@Profitap Thank you Profitap for creating these fun quizzes every year. I always enjoy the challenge. I'm very happy to have won and I'm looking forward to trying out the IOTA 1G.

[Phil Storey @PhilStorey24]

@Profitap Thanks everyone! These quizzes are always fun (and get the grey matter going).

[Phil Storey @PhilStorey24]

@debookee @SYNbit @packetpioneer @PacketDetective @PacketJay @PacketBomb @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader The "bad" SACK behaviour is on the NAS. Are you certain that your Windows clients don't experience the same behaviour? It seems that they should.

[Phil Storey @PhilStorey24]

@debookee @SYNbit @packetpioneer @PacketDetective @PacketJay @PacketBomb @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader Here's a chart from the newer trace. I've tried to explain things via popups. Many retrans (purple) in response to SACKs aren't ack'ed and are sent again (after an RTO?).
Receiver seems to stop SACK'ing even though the Dup-Ack count implies more data was received.

[Phil Storey @PhilStorey24]

@SYNbit @debookee @packetpioneer @PacketDetective @PacketJay @PacketBomb @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader I missed this point yesterday (too many SACKs). Well done on spotting that.

[Phil Storey @PhilStorey24]

@debookee @SYNbit @packetpioneer @PacketDetective @PacketJay @PacketBomb @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader Yes, I now see the inconsistency. In today's newer trace, I see 356 SACKs. This implies that 356 data packets got through after the first reported loss. That's far more data than the SACKs actually acknowledge. Another chart later today.

[Phil Storey @PhilStorey24]

@SYNbit @debookee @packetpioneer @PacketDetective @PacketJay @PacketBomb @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader I see your point now Sake (which I missed yesterday). The count of Dup-Acks (aka SACKs), 356 in an example from the newer trace, implies that more data packets were received than shown in the max SACK RE. Due to that, the sender wrongly treats packets as "lost" and retransmits.

[Phil Storey @PhilStorey24]

@SYNbit @debookee @packetpioneer @PacketDetective @PacketJay @PacketBomb @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader I'll have another look tomorrow.

[Phil Storey @PhilStorey24]

@debookee @packetpioneer @PacketDetective @PacketJay @PacketBomb @SYNbit @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader 4) There doesn’t seem to be anything wrong with the SACKs. The 12 retransmissions happen when the receiver knows we're in loss recovery mode. The 400KB retrans have "100ms delayed acks" because the receiver doesn't know we're in loss recovery mode.

[Phil Storey @PhilStorey24]

@debookee @packetpioneer @PacketDetective @PacketJay @PacketBomb @SYNbit @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader 2) The 12 lost packets (drawn as red cross-hatch) were eventually retransmitted one per RTT with a SACK ack'ing each one. After those 12 are all done (red cross-hatch is filled in), all the light blue area is properly ACKed.

[Phil Storey @PhilStorey24]

@debookee @packetpioneer @PacketDetective @PacketJay @PacketBomb @SYNbit @crnetpackets @hansangbae @bockcay @LauraChappell @PcapReader 1)Looks like a group of 12 packets got lost in the network – based on the SACKs. The subsequent packets (drawn as light blue by NetData’s SACK drawing mechanism) did get through.
About 400KB of data packets after that (above the light blue) didn’t get through either.

[Phil Storey @PhilStorey24]

@Sarkies_Proxy @PacketBomb If you hover on a legend item you'll see where those things occur.

[Phil Storey @PhilStorey24]

@Sarkies_Proxy @PacketBomb Looks like you've got a bit of everything there, given the legend list.

[Phil Storey @PhilStorey24]

@Sarkies_Proxy @PacketBomb Apologies Dave. I updated the zip and forgot to include "https://t.co/qFIeHScfv7" that contains several necessary ".dll" files. Just extract them into the same folder as the main ".exe". I've uploaded a new "https://t.co/UecmGzl5nQ" just now. It has the latest ".exe" version.