[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] new signature SensorStatistics (MU20.13)



> I have tried the new signature SensorStatistics from the MU 20.13.
> 
> It's very interesting but i would like to know the exact 
> signification of this parameter: tcp.misseddata_acks.
> Indeed, i have always a high value for this (1/3 of the
> parameter tcp.synacks) and i don't think it is normal.
> 
> Thanks vy advance for any information,

The statistic tcp.misseddata_acks represents the number of TCP
packets which have acknowledged data not observed by the sensor.

A high value in this statistic could be indicative of one
or more of the following conditions:
 a) packet loss at the network traffic aggregation point
	(e.g., spanning ports can be lossy during traffic spikes)
 b) an asymmetrical route
 c) packet loss at the driver level of the network sensor
 d) someone using a tool which attempts to pre-ack data
	coming from a server, in the misguided hopes that
	doing so will increase the overall throughput of
	the transfer

The most likely cause for a high value in this statistic
is packet loss at the traffic aggregation point.

Hope this helps,
 Jacob

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo