We don’t have the information about the server at this time. The article links to a known bug for the Nexus 7000:īefore pointing the finger at the Nexus it would be advisable to verify, if the conditions given in the bug report are met in this special configuration. The Cisco support forum shows an entry with similar conditions: In situations like that it is often useful to locate similar symptoms in various support forums. As the problem only manifests itself in SMB or SMB2 traffic we eliminate these reasons. The question on tells us that the slow performance is quite common and can be reproduced.

Electrical charges from nearby electric devices (elevator motor, forklift trucks, nearby train stations).

Misconfigured teaming on the server side.

A change in the network topology (Layer 2 or 3).

The packet loss could be caused by a number of events.

The lost ACKs were not a single event, but occurred multiple times.

We can conclude, that more than one ACK from the client was lost.

The server retransmits data, despite the fact that we send our retransmissions.

Our client trace does not show packet loss.

We see a TCP throughput that matches the pattern of massive packet losses and TCP slow starts.

Using Wireshark’s service response time (SRT) function we can confirm a very long response time from the file server.

This packet loss is definitely not caused by the client side. The server must have missed a rather large number of ACKs to undergo a TCP slow start. Our client is dutifully acknowledging data.

When analyzing slow SMB or SMB2 connections it is often advisable to investigate transactions that occur often or cause a long total time, as specified in the column Sum SRT: So we can assume, that the trace shows the client view of things. The client side shows a TTL of 128, the server side shows a TTL of 55. The RTT from the 3-way-handshake is 23 msec. We find one really interesting TCP connection on source port 63726.

The file being analyzed is C_to_H_200MB.pcap. For the next days the number of views increased significantly. Since the question nicely fits into the scope my talk on Sharkfest Europe last week I have asked the attendees to take a look at the question. The question and a link to the traces can be found here:

Upon request the person asking the question was able to add a couple of trace files (=”capture” files). We had an interesting question regarding SMB2 performance on the Wireshark Q&A forum recently.

Tcp dup ack wireshark