Showing results for 
Show  only  | Search instead for 
Did you mean: 

Retransmitted packets sent/received per second on host


Dear All,

There are a couple of servers with constant retransmitted packets received per second on the host. What could be the issue?

Is the retransmission issue with the host receiving calls or with the host who made the calls?

One more following example for the calls only.




Retransmissions might occur normally in many cases, mainly when clients have poor connectivity or bandwidth might be constrained somewhere. Do you know what type of clients are accessing these services?

Hello @Antonio S.

The center process is calling to other processes. In this situation, the retransmission issue is with the highlighted outgoing processes or the source/center process making calls to those processes?



I think I get it better now. But it might be confusing because all the processes have the same name 😉

So, from the last graph you sent (the process connections one), I believe that the values that are in the red squares are the sum of incoming/outgoing retransmissions.

Not sure yet what the first graph is, but if the second graph (the one with "Retransmissions received" in yellow) is what I think, it is related to the process highlighted in the middle of your last graph. So, if there are retransmissions received there, it means that the two processes to the right are retransmitting packets to the one in the middle. Now, that doesn't say much, as packets might be lost on either way of their transit.

Now, the percentage of retransmissions might seem high, but in fact the whole quantity is low. That is confirmed by the little amount of traffic. So, it wont be that bad. There is one problematic aspect though, as the retransmissions seem to be very steady.

If the servers that support these processes are in the same datacenter, than I would say that this is a problem. But, given the circunstances, I would almost bet they are connected by a WAN, in which case I would not consider these values problematic.

In any case, you will probably get a faster explanation if you could get a network capture. Given that it's so much little data, it should be pretty fast do determinate what's going on here.

Hello @Antonio S.

Yes. The traffic is low, and the retransmission received is steady. All hosts/processes in the same location/datacenter but there is a logical distribution in the same datacenter, for example, DH # 1 and DH # 2.

I will confirm the location/placement of these hosts and then will discuss with you further.



If that's the case, then there is really something potentially strange going on.

Another thing that is surprising is the slight rise of retransmissions in the dawn. Might that be a different timezone from yours?

In any case, as I told you, a tcpdump capture with only the involved TCP port would probably explain this much faster...


To be able to clearly identify the origin and destination, I recommend you get a PCAP with warshack. Dynatrace does identify the broadcasts, but it is very difficult to know the destination