There are a couple of servers with constant retransmitted packets received per second on the host. What could be the issue?
Is the retransmission issue with the host receiving calls or with the host who made the calls?
One more following example for the calls only.
Retransmissions might occur normally in many cases, mainly when clients have poor connectivity or bandwidth might be constrained somewhere. Do you know what type of clients are accessing these services?
So, from the last graph you sent (the process connections one), I believe that the values that are in the red squares are the sum of incoming/outgoing retransmissions.
Not sure yet what the first graph is, but if the second graph (the one with "Retransmissions received" in yellow) is what I think, it is related to the process highlighted in the middle of your last graph. So, if there are retransmissions received there, it means that the two processes to the right are retransmitting packets to the one in the middle. Now, that doesn't say much, as packets might be lost on either way of their transit.
Now, the percentage of retransmissions might seem high, but in fact the whole quantity is low. That is confirmed by the little amount of traffic. So, it wont be that bad. There is one problematic aspect though, as the retransmissions seem to be very steady.
If the servers that support these processes are in the same datacenter, than I would say that this is a problem. But, given the circunstances, I would almost bet they are connected by a WAN, in which case I would not consider these values problematic.
In any case, you will probably get a faster explanation if you could get a network capture. Given that it's so much little data, it should be pretty fast do determinate what's going on here.
Hello @Antonio S.
Yes. The traffic is low, and the retransmission received is steady. All hosts/processes in the same location/datacenter but there is a logical distribution in the same datacenter, for example, DH # 1 and DH # 2.
I will confirm the location/placement of these hosts and then will discuss with you further.
If that's the case, then there is really something potentially strange going on.
Another thing that is surprising is the slight rise of retransmissions in the dawn. Might that be a different timezone from yours?
In any case, as I told you, a tcpdump capture with only the involved TCP port would probably explain this much faster...