[c-nsp] Excessive TCP retransmits across 2xT1 MLPPP WAN link - SMB

[Sam Crooks]

Hi,

I have the following situation, and am trying to nail it down to what I
think is the issue:

For a particular subnet or set of servers, in doing MS SMB file sharing,
browsing, etc (src_ip:src_port <--> dest_ip:445/tcp)  it fails.

In sniffing the traffic, SMB logon and directory listing, file xfer, etc
appears to start, however at some point fail due to excessive lost
packets, dup acks, or retransmits.

In sniffing the traffic at the WAN link, I see a lot of SMB echo, some
lost segments, and some retransmits, some dup acks.  Sniffing at the
core, I see every other packet is a re-transmit, with the occasional
lost or dup ack in there. (not just for this session of pair of hosts...
basically everything pushing a lot of traffic through the "core")



So.... would people agree that the "core" uplinks are oversubscribed?
And without QoS, data is going out to the WAN too fast, being dropped by
the router? Same service not over the WAN link has some retransmit
issue, but not enough to drop the connection.  Pushing files one way...
lots of retransmits, but it goes.... the other way... the browse or file
xfer never starts.  Issue also seems to be intermittent and one sided...
>From what I can gather in data (no SNMP management monitoring going on
here), it seems to be time/usage based.  I have tried multiple hosts and
OS. (linux, XP, 2k3)  

*note* issue popped up when the desktop guys threw all the users on Gbps
port switches uplinked to agg/core with 1Gbps uplink per 24 Gbps user
ports. Users are Oracle developers and seem to push a ton of data
around.   Segment in question is heavily used for replicating SQL
servers back and forth.


PS: I'm trying to build the case to dump the "core" Dell PowerConnect
6024 L3 switch and PowerConnect 5324 access switches for something that
can do QoS, packet marking/shaping, etc


  
Sam

CONFIDENTIALITY NOTICE:
This message, and any attachments, are intended only for the lawful and specified use of the individual or entity to which it is addressed and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you are STRICTLY PROHIBITED from disclosing, printing, storing, disseminating, distributing or copying this communication, or admitting to take any action relying thereon, and doing so may be unlawful. It should be noted that any use of this communication outside of the intended and specified use as designated by the sender, may be unlawful.  If you have received this in error, please immediately notify us by return e-mail, fax and/or telephone, and destroy this original transmission and its attachments without reading or saving in any manner.