When users complain of slow response times, the network administrator can do a quick packet capture and observe evidence of trouble. We will walk through some examples to demonstrate how you can identify issues on the network. If you would like to follow along, go to https://www.cloudshark.org/captures/9a5385b43846, download the client-fast-retrans.pcap capture, and open it in Wireshark.

Once the capture is open, we can scroll through the capture. Around packets 20-21, we can see potential problems, as indicated by the black coloring rule seen within the capture:

As shown, both duplicate acknowledgments and fast retransmission are evident in packets 20-21 and 23-24. Both duplicate acknowledgments and fast retransmissions can occur on a network. However, when there is an excessive number of them, this is generally an indication of congestion.

Generally, there are three indicators in measuring performance: latency, packet loss, and throughput. Let's take a look at each of these and how they can point to evidence of an unstable and sluggish network, beginning with latency.