Phil Storey

NetData's Queue Modelling feature shows that in @SYNbit's @wiresharkfest "SACKed" PCAP, a downstream link of 916 Kbps caused a queue which added 4 secs to RTTs. Packets were dropped when 500 KB or 335 packets (the red areas) filled the buffer. Green=model RTTs; black=real RTTs.

Just uploaded my latest "Using NetData Lite" video - "#9 Waterfall Chart". This chart type can be used to forecast the user impact when moving servers to different data centres (or to the cloud). youtu.be/pwj3MZZMK2A

I've just uploaded my latest YouTube video. It re-examines the Ask Wireshark question as I tweeted in 2018 and as I discussed in my interview with @PacketBomb youtu.be/gBCPjrYgUzA

I'm really looking forward to this. I've been busy this week creating "how to" videos. youtube.com/playlist?list=PL…

Joke: All Internet apps have to be rewritten to use UDP - so that we can avoid TCP Handshakes. I only heard this yesterday and am surprised it took so long. Also disappointed that I didn't think of it myself. Do we have to say, "TCP Elbow Bumps" now?

Full 2 minutes now. This is from Ask Wireshark Q-5043. Fairly regular repeated pattern. Measured RTTs include up to 800ms of queue time on top of the min-RTT of 55ms (see popup). Note the red markers nearly always at ~100KB (68 segments) of in-flight data.

Zoomed-out we see a repeating pattern of slow in-flight ramp up with rapidly increasing RTTs because of a queue at the slow WAN interface. When the queue fills (usually ~100KB but sometimes less) we get losses and SACK/retrans recovery. Repeat pattern. Server RWIN never filled.

Zoomed to the "SACK" area, light blue means "SACK says received" and cross hatch means "SACK says not received". The 1st set of purple retransmissions exactly fill-in the cross hatch but there are unnecessary 2nd & 3rd sets (which prompt 2 matching sets of D-SACKs).

Here's a great 1Mbps egress queue example. Bottom part shows in-flight data ramping up with red "ticks" showing that losses always began at ~100KB. Black squares are individual measured RTTs. They neatly increase as queue time is added, flattening when the queue is full.

Interesting new Azure feature that is of interest to those of us that love to get our hands on packets. docs.microsoft.com/en-us/azu…

Zoomed in: The green out-of-order packet triggered 6 SACKs and an unnecessary retransmission. Receiver sent a D-SACK informing that it received the same data twice. CWND drops from 28 to 14. Two other OOO’s didn’t affect throughput.

TCP "Congestion Avoidance" linearly increasing packets per trip to 28, a retrans causing halving to 14 ; 21 to 10 ; 14 to 7. Packets are out-of-order enough to trigger 6, 4, 6 SACKs (small numbers under Ack line). Other OOO’s are too small to trigger retrans.

Great example of out-of-order packets & “TCP Congestion Avoidance” killing throughput (dashed line). Green "sawtooth" plots in-flight data. Unnecessary retrans make sender halve cwnd repeatedly, staying below 40 KB even though rwnd is a constant 128 KB.

Slow Tra... lovemytool.com/blog/2018/03/… This article on the "Love My Tool" website walks though an analysis of a packet-loss scenario that left the network owner "at a loss". It shows that packet captures can not only indicate packet losses but can also reveal their causes.

Part 2 of 4 of Bob Brownell's LoveMyTool article. Describes an unusual Cisco ASA FW behaviour that can mislead you. lovemytool.com/blog/2017/02/…

It looks as though an IANA website, is not respecting a client's Receive Window. What do you think? ask.wireshark.org/questions/…

Great first LoveMyTool article by Bob Brownell, the developer of NetData. lovemytool.com/blog/2016/12/…

"My Solution to the SharkFest 2015 “Megalodon Challenge”" on @LinkedIn linkedin.com/pulse/my-soluti…

Hi @WolfeTechapps.