Hello fellow networkers, I have a couple of questions about TCP.
Here is the scenario: one Siemens PLC connected on a switch is "chatting" with a machine connected on the same switch.
The PLC sends 2 packets/messages per second to an application on the machine, machines sends 1 ACK confirming both packets. The PLC itself is meant to report real-time data, so retransmitted packets are ignored by the application due to them no longer being relevant.
So what ends up happening is that, during any one day, 3 to 9 packets fail to reach their destination and get retransmitted, however seeing as retransmitted data is not treated, they are considered as "lost" by the application.
There is little to no utilisation on the switch ports themselves, CPU is stable as well. No visible anomalies on the machine receiving the packets either.
The packets sent are 148 & 150 bytes in size.
On Wireshark I can see the packets correctly leaving the PLC switch port, however the port on which the machine is connected I can see only one of the two messages reaching the device and an ACK that acknowledges the last packets that succesfully reached the machine, this is done 3 times after which a Fast Retransmission is triggered and the process of working correctly resumes until the next packet loss occurs.
My question is this: TCP is built for packet losses, complementing them with retransmissions and fast retransmissions, but is it normal to experience packet loss/retransmissions from time to time on a nearly 1 to 1 connection ?
Also, I'm relatively fresh to packet capture analysis, shouldn't I see the TCP Fast retransmission on both ports ? I can only see them on the receiver's end, is it because those kinds of things are managed at a protocol level ?
Thank you
No comments:
Post a Comment