Too many retransmission of packets

[Mel Burslan]

Our network folks are telling us that one of the servers in data center, is causing too many packet retransmits. I was not sure what they were referring to, with this phrase and thought it was too many collisions, but no, it is not the collision they say. It is like the SYN requests to this server do not get the ACK signal/packet in a timely manner, causing packets to be retransmitted. Since I am not an expert on networking internals, I just have a gut feeling that, it may be related to one or more parameters on ndd.

system is a 2 CPU A500-6X machine.
only LAN i/f enabled is the built in lan0
it has 2 more 10/100 i/f on lan/scsi combo cards but they are not being used at this time
lan driver for lan0 is btlan
system is up for 290 days

Any suggestions are appreciated.

[D Block 2]

did you collect anys Statistics using netstat ? How about running Glance also? Glance has a great status on the network cards showing BAD packets. If you don't have Glance, maybe you can install a free 30 day license.

also, look at the hardware ? following the cables and link-lights on the router/switch.
I assume you have a switch right?

If you use HUBS, there you go, retransmitions, collisions... remove all the hubs and replace with Switchs, if so.

run: netstat -an
look for status field, run this to a log every 2 minutes.. in a loop.

you can also do a:
traceroute command to your gateway or other systems.

also, check you defines options in your nic card by running:

lanadmin -X
where is the index from:
ioscan -fknC lan

know your TCP network parameters:
man ndd

[Brad Marks]

Mel,
We had a similar problem start yesterday afternoon. Our network was getting flooded with ARP packets from PCs that picked up a virus ('winmplyer.exe' we think).
I downloaded freeware called 'Ethereal' that gave me the IP addresses of offending PCs. I then shut these PCs off.
Now all I need is a antidote for this virus.

Hope this helps,
Brad