cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
802
Views
0
Helpful
4
Replies
Beginner

wireshark shows tcp retransmission & dup ack packet on wccp traffic, does it look correct?

Hi -

Did a packet capture on WAAS running L2 WCCP with switch, saw many tcp retransmission & dup ack packets, first i thought something is not right but then i looked back again, this may be corrected.  Since WAAS is intercepting network traffic then sending it back out on the same interface.  From wireshark perspective, the same traffic is travelling in and out of same interface 2 times, so wireshark thinks and marks this traffic as "retransmission & dup" packet.  Does it make sense? or i am missing something.  Can someone shed some light please?

Thanks

4 REPLIES
Participant

Hi Joe,This is completely as

Hi Joe,

This is completely as expected, you'll see the (same) traffic entering and leaving the WAAS box.

However for optimized traffic, you should see different TCP sequence numbers on the packets leaving the WAAS box, that in the other direction. Of course you should also see e.g. different packet sizes etc. due to DRE or LZ kicking in, for optimized packets.

 

Best regards

Finn

Beginner

Thanks Finn! I think the TCP

Thanks Finn! 

I think the TCP sequence number should be the "same" that is how wireshark know it is a "retransmission" packet.  but, for optimized traffic we should see different packet size due to TFO,DRE,LZ kick in.

Thanks 

Participant

Hi Joe, The TCP sequence

Hi Joe,

 

The TCP sequence numbers are only the same for unoptimized traffic (i.e. PassThrough).

This is one of the mechanisms, that the remote WAAS detects whether the other end has disappeared and the TCP session gets re-established.

 

Finn

Beginner

Hi Finn -Thanks so much for

Hi Finn -

Thanks so much for taking time to answer my questions, I appreciated.

However, that is not what i saw on wireshark.  The "original" and "retransmission" optimized packet have the "same" tcp sequence number.

I am going to create a Cisco TAC ticket, will report back in here.

Thanks

CreatePlease to create content
Ask the Expert- DMVPN on Cisco routers