I noticed this while checking the performance of our Teamviewer connections. If i start a download test, the following pattern can be observed in the TCP stream graph provided by Wireshark:


The red arrows mark the observed TCP DUP ACKs and TCP Fast Retransmission events:

Wireshark Log

I'm able to lower the number of DUP ACKs by enabling and tuning QoS settings on our Sophos firewall. The number of DUP ACKs goes down from a few hundred down to about 20-30.

enter image description here

My question is if this is normal for a saturated downlink or should i investigate further? I ran the tests on our 16MBit SDSL line while only maxing out the download bandwidth.

  • 3
    This is normal on saturated links. Packet drops caused by congestion is the reason for the DUP ACKs. – Winnie Tigger Jun 8 '18 at 9:14

When a link becomes saturated and the queueing depth increases significantly a sudden delay is introduced to the stream. This often causes unnecessary retransmissions because the ACKs for the queued data segments were't received in the expected time window (or the ACKs were delayed in the opposite direction).

With a constant load level the retransmissions should even out as TCP's RTT tracking adapts but with the loads changing permanently, retransmission counts will likely stay on that level.

QoS can help reduce the queueing delay but there's only so much you can do from one side of a link.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.