Friday, November 2, 2018

Trying to understand why TCP SYN packets would occasionally be dropped

A customer of ours is dealing with an issue which is being caused by their (Windows) servers having to retransmit TCP SYN packets occasionally. When no SYN/ACK response is received, the retransmit delay is 3 seconds, and that delay is causing users some issues (they are moving PTZ cameras in realtime). In normal use it happens maybe 4-5 times in an 8 hour period so it's not happening a lot, but it's enough to cause a headache.

At this stage there is not much I can do from the software perspective and I'm trying to provide them with enough guidance to diagnose the issue as we're not responsible for their server hardware, network infrastructure, or cameras.

I've recommended that they setup port mirroring on an edge switch, and capture a packet trace on both ends of the connection. That way they can find out if it's the SYN packet not making it to the camera, and if so, whether the SYN/ACK makes it out of the camera at all.

I haven't seen any evidence of network congestion or high resource usage on the servers, but I'm wondering if anyone has seen any obscure/advanced TCP stack settings that can cause weird issues like this?



No comments:

Post a Comment