TCP module: Difference between revisions

TCP module (view source)

Revision as of 12:27, 6 May 2020

1,608 bytes added , 6 May 2020

no edit summary

Ralf

547

edits

@@ Line 59: / Line 59: @@
 This tab shows all IP addresses with TCP traffic and the aggregated amount of TCP payload sent and received and the amount of data that needed to be retransmitted due to packet loss.
+=== Meaning of retransmission values ===
+To calculate retransmission values, we use the difference of the actual bytes transmitted via TCP to the bytes announced via TCP sequence numbers. This means that retransmission values and ratios can both be positive and negative:
+{| class="wikitable"
+|-
+! Meaning of positive retransmission values !! Meaning of negative retransmission values
+|-
+|
+# more TCP payload has been transmitted than indicated by TCP sequence counters
+# additional bytes are retransmission
+# usually happens due to packet loss somewhere between sender and receiver
+## if loss happens before the multimeter, the initial packets are of course not seen and can therefor not taken into account. However, in the reverse direction we will see the duplicate packets and will account them for retransmissions
+## if loss happens after the multimeter, the retransmissions are accounted for this direction, but for the reverse direction, the initial packets will not be seen.
+# Example:
+## sequence counters changed by 1000 bytes
+## TCP payload seen was 1500 bytes
+## => 500 bytes retransmissions
+||
+# less TCP bytes has been seen than indicated by TCP sequence counters
+# the *Allegro Network Multimeter* did not see all TCP packets
+# usually happens due to measurement setup problems
+## mirror port overloaded
+## device overloaded
+## measurement point does not see complete traffic (e.g., port aggregation used but only one port mirrored)
+# Example:
+## sequence counters changed by 1000 bytes
+## TCP payload seen for 500 bytes
+## => -500 bytes "retransmissions" or in other words unseen bytes
+|}