If the network trace is taken from a spanned switch port to capture all the data on the subnet, you will see traffic similar to the following: No. This is due to the load balancer modifying only the Ethernet header (replacing the source and destination MAC addresses to send the new frame to the designated node of the load balanced set).

For example, retransmissions in traces are very common when using a single NIC hardware load balancer. And while TCP retransmissions generally are not considered a good sign, they are not always a bad sign, nor are they always the cause of a given problem. TCP Retransmissions in traces are a very common problem. If you are new to the series, you can find part 1 here, and the whole series here. Check this post for more details.Īuthor’s Note: This is the second part in a six-part series about finding and solving many networking anomalies using the Wireshark network protocol analyzer. Tried another ACP.NOTE: You can now take course by the author with video and example traces on Wireshark. It looks like this is related to massive 'TCP Retransmission' in Wireshark logs somehow. Is this normal on any wireless network? If not, how can I fix my laptop so it can surf the internet stably as my desktop PC?Įdit: I tried to capture the TCP packet again while the page failed to completely load. I managed to capture network traffic on my laptop with Wireshark which results in the image below:įrom what I know, the black-background rows show that there are erros in TCP checksum / Bad TCP. This is not happening to my desktop PC which is connected to the same D-Link AP as well. Sometimes it works, but most of the time it couldn't load the page completely or not loaded at all.

My Thinkpad X200 laptop which use Intel Wifi Link 5100 AGN is not able to surf the internet stably. I am troubleshooting wireless connectivity problem in my home network.

Tcp retransmission wireshark