Wireshark TCP Retransmissions: Expert Info When Users Say 'The Internet Is Slow'

SOC / packet analysis · Techclick CLI troubleshooting lab

Users say slowness. Bandwidth looks fine. You have a 30-second pcap from the client.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on SOC / packet analysis for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Expert Information > Retransmissions and Dup ACKs. If they cluster one way, that path is dropping. It is not 'the internet'.

Why this ticket shows up

Slowness with spare bandwidth is loss or window, not capacity. Retransmits name the direction.

Symptoms operators actually see

• High retrans %

• Dup ACKs

• Window full

• Only one SaaS or all destinations

CLI first — copy this block

Run these on the SOC / packet analysis device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tshark -r client.pcap -q -z io,stat,1
tshark -r client.pcap -Y 'tcp.analysis.retransmission' -T fields -e ip.dst | sort | uniq -c | sort -nr | head
tshark -r client.pcap -Y 'tcp.analysis.zero_window'
capinfos client.pcap

How to read that output

Retransmits toward one prefix mean that path. Zero window means the receiver is slow, not the network.

Triage order

1. Run expert/retrans stats

2. See if loss is to one dest or all

3. If all, check local Wi-Fi/NIC

4. If one, check that SaaS/firewall

5. Do not upgrade the circuit yet

Classic traps

What you see	Real cause	Fix
Buy more bandwidth	Retransmits are loss	Fix the drop
Blame the server CPU	Zero window is the receiver	Only then blame the host
Capture on the wrong side	You will invert the direction	Capture both if you can

Proof the ticket is closed

• Retrans % drops after the fix

• User timing improves

• Direction was documented

Say this in an interview

I use retransmissions to pick a direction. Slowness is not a bandwidth number.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/