I noticed this while checking the performance of our Teamviewer connections. If i start a download test, the following pattern can be observed in the TCP stream graph provided by Wireshark:
The red arrows mark the observed TCP DUP ACKs and TCP Fast Retransmission events:
I'm able to lower the number of DUP ACKs by enabling and tuning QoS settings on our Sophos firewall. The number of DUP ACKs goes down from a few hundred down to about 20-30.
My question is if this is normal for a saturated downlink or should i investigate further? I ran the tests on our 16MBit SDSL line while only maxing out the download bandwidth.