{"id":3090,"date":"2020-07-30T14:02:28","date_gmt":"2020-07-30T13:02:28","guid":{"rendered":"https:\/\/kudzia.eu\/b\/?p=3090"},"modified":"2020-08-18T09:44:51","modified_gmt":"2020-08-18T08:44:51","slug":"detecting-duplicate-packets-from-command-line","status":"publish","type":"post","link":"https:\/\/kudzia.eu\/b\/2020\/07\/detecting-duplicate-packets-from-command-line\/","title":{"rendered":"detecting duplicate network packets from linux command line"},"content":{"rendered":"

while going down the rabbit hole of bed network performance at work we’ve narrowed the problem cause to duplicate packets showing up on a specific segment of leased metro Ethernet service. tshark filter helped us to see when duplicates occurred on monitored link<\/p>\n

we’ve got pair of computers – A and B connected at both ends of the leased line. on A, having address 10.99.0.1, we’ve run <\/p>\n

\r\niperf3 -s\r\n<\/pre>\n
on B:<\/p>\n
\r\niperf3 -c 10.99.0.1 -b 100m\r\n<\/pre>\n
tshark running in parallel on A:<\/p>\n
\r\ntshark -Y &quot; tcp.analysis.duplicate_ack &quot; -n -i eno1 port 5201\r\n<\/pre>\n
gave us plenty of:<\/p>\n
\r\n128517 184.731650531    10.99.0.1 \u2192 10.99.0.2    TCP 78 [TCP Dup ACK 128510#3] 5201 \u2192 54634 [ACK] Seq=1 Ack=123520206 Win=406784 Len=0 TSval=4096524269 TSecr=3598616679 SLE=123521654 SRE=123533238\r\n128519 184.731754636    10.99.0.1 \u2192 10.99.0.2    TCP 78 [TCP Dup ACK 128510#4] 5201 \u2192 54634 [ACK] Seq=1 Ack=123520206 Win=406784 Len=0 TSval=4096524270 TSecr=3598616679 SLE=123521654 SRE=123536134\r\n128521 184.732136484    10.99.0.1 \u2192 10.99.0.2    TCP 78 [TCP Dup ACK 128510#5] 5201 \u2192 54634 [ACK] Seq=1 Ack=123520206 Win=406784 Len=0 TSval=4096524270 TSecr=3598616679 SLE=123521654 SRE=123542678\r\n128829 184.805138628    10.99.0.1 \u2192 10.99.0.2    TCP 78 [TCP Dup ACK 128827#1] 5201 \u2192 54634 [ACK] Seq=1 Ack=124427574 Win=408192 Len=0 TSval=4096524343 TSecr=3598616753 SLE=124429022 SRE=124431918\r\n<\/pre>\n
interestingly bbr tcp congestion control algorithm handles very well such link and significantly degraded performance was noticeable when sender was using cubic<\/i> algorithm.<\/p>\n","protected":false},"excerpt":{"rendered":"
while going down the rabbit hole of bed network performance at work we’ve narrowed the problem cause to duplicate packets showing up on a specific segment of leased metro Ethernet service. tshark filter helped us to see when duplicates occurred on monitored link we’ve got pair of computers – A and B connected at both […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51],"tags":[],"class_list":["post-3090","post","type-post","status-publish","format-standard","hentry","category-unimportant"],"_links":{"self":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/3090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/comments?post=3090"}],"version-history":[{"count":5,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/3090\/revisions"}],"predecessor-version":[{"id":3098,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/3090\/revisions\/3098"}],"wp:attachment":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/media?parent=3090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/categories?post=3090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/tags?post=3090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}