If the network trace is taken from a spanned switch port to capture all the data on the subnet, you will see traffic similar to the following: No. This is due to the load balancer modifying only the Ethernet header (replacing the source and destination MAC addresses to send the new frame to the designated node of the load balanced set). For example, retransmissions in traces are very common when using a single NIC hardware load balancer. And while TCP retransmissions generally are not considered a good sign, they are not always a bad sign, nor are they always the cause of a given problem. TCP Retransmissions in traces are a very common problem. If you are new to the series, you can find part 1 here, and the whole series here. Check this post for more details.Īuthor’s Note: This is the second part in a six-part series about finding and solving many networking anomalies using the Wireshark network protocol analyzer. NOTE: You can now take course by the author with video and example traces on Wireshark.
0 kommentar(er)
