Albert Jurado wrote: > I've looked at the captures and there's no reason to believe that the packets > are duplicates. >I've filtered the capture to show the communication between the terminal server
>and the SQL server. When I apply this filter every other line in the >wireshark display >shows the "This frame is a (suspected) out-of-order segment". > > This much fragmentation just doesn't seem normal. Can someone please shed some light on this.. >There's a part of me that thinks I'm chasing a ghost and that the problem is related to >the way wireshark captures terminal server communication. It's trivial to see if in fact they are out of order. Just follow the tcp sequence numbers to see if they are out of order. You can't really have that many out of order packets unless a few specific conditions are met (these are corner/academic cases). 1) You have a redundant network path and one path is slightly slower than the other. *AND* someone turned on per-packet-cef or is process switching the traffic causing per-packet load balancing to occur. 2) Your span (monitor) session is watching two interfaces and one is more overloaded than the other. So the packets were never out of order but they *got* to the wireshark machine out of order. But for it to be off by every other packet is next to impossible. If you post a small sample (10 packets is sufficient) we may be able to assist more. Please keep them in the pcap format. One big Blue's Clues you can check for. Are the IP ID field same on the two packets? Come to think of it. Wireshark would tag them as "suspected retransmission" as opposed to out of order packets. Now I would really like to see the pcap data. You don't have to upload the entire packet, you can chop it at 96 bytes or so with editcap. -- Thanks, Hansang _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
