rc.39 missing sloss for TCP retransmits
Christoph Badura
bad at bsd.de
Tue Feb 27 18:50:40 EST 2007
Hey Carter,
more weird output from the traces I took last week.
These three flows report sloss of 0 although each had multiple events where
trains of typically 25 or 40 contingous packets were lost and retransmitted
on receipt of SACKs.
Output from "racluster -n -s +sloss +dloss -r trace7s.argus":
14:28:26.545754 d tcp 1.2.3.4.38615 -> 4.3.2.1.22 7508 3841 11195264 262685 FIN 0 1
loss pattern 39, 34, 25 packet trains
14:29:02.415526 tcp 1.2.3.4.38773 -> 4.3.2.1.22 7470 3845 11185968 263585 FIN 0 0
loss pattern 27, 39, 20, 16, 15 packet trains
14:29:34.221108 tcp 1.2.3.4.38778 -> 4.3.2.1.22 7446 3828 11102864 261431 FIN 0 0
loss pattern 40, 23 packet trains
I would find it useful if I could distinguish these unusal losses where a
train of 20-40 kbyte worth of TCP segments is lost en-bloc from more normal
loss of single packets once in a while (possibly from loss because of filling
the pipe).
I think I can liberate the raw traces for this and the ESP stuff I posted
about earlier if you want them for reqression testing.
regards,
--chris
More information about the argus
mailing list