All Packets Duplicated - microsoft/CSS_SQL_Networking_Tools GitHub Wiki
All Packets Duplicated
In some cases, you may notice that all the packets in a network trace are duplicated.
Frame Offset Source IP Dest IP Description
----- ----------- ----------- ----------- -----------------------------------------------------------------------------------------------
2631 140.1400414 10.10.10.10 10.10.10.22 TDS:RPCRequest, Version = 7.300000(No version information available, using the default version)
2632 140.1400424 10.10.10.10 10.10.10.22 TCP:[ReTransmit #2631]Flags=...A...., SrcPort=37768, DstPort=1433, PayloadLen=1460, Seq=9357361
2633 140.1400539 10.10.10.22 10.10.10.10 TCP: [Bad CheckSum]Flags=...A...., SrcPort=1433, DstPort=37768, PayloadLen=0, Seq=907541922, Ac
2634 140.1400545 10.10.10.22 10.10.10.10 TCP:[Dup Ack #2633] [Bad CheckSum]Flags=...A...., SrcPort=1433, DstPort=37768, PayloadLen=0, Se
2637 140.1401051 10.10.10.10 10.10.10.22 TDS:SQLBatch, Version = 7.300000(No version information available, using the default version),
2638 140.1401061 10.10.10.10 10.10.10.22 TCP:[ReTransmit #2637]Flags=...AP..., SrcPort=36816, DstPort=1433, PayloadLen=90, Seq=101311560
2639 140.1401278 10.10.10.22 10.10.10.10 TDS:Response, Version = 7.300000(No version information available, using the default version),
2640 140.1401294 10.10.10.22 10.10.10.10 TCP:[ReTransmit #2639] [Bad CheckSum]Flags=...AP..., SrcPort=1433, DstPort=37768, PayloadLen=74
2641 140.1401518 10.10.10.22 10.10.10.10 TDS:Response, Version = 7.300000(No version information available, using the default version),
2642 140.1401531 10.10.10.22 10.10.10.10 TCP:[ReTransmit #2641] [Bad CheckSum]Flags=...AP..., SrcPort=1433, DstPort=36816, PayloadLen=48
2643 140.1402283 10.10.10.22 10.10.10.10 TDS:Response, Version = 7.300000(No version information available, using the default version),
2644 140.1402302 10.10.10.22 10.10.10.10 TCP:[ReTransmit #2643] [Bad CheckSum]Flags=...AP..., SrcPort=1433, DstPort=47962, PayloadLen=16
2659 140.1408609 10.10.10.10 10.10.10.22 TDS:SQLBatch, Version = 7.300000(No version information available, using the default version),
2660 140.1408616 10.10.10.10 10.10.10.22 TCP:[ReTransmit #2659]Flags=...AP..., SrcPort=37768, DstPort=1433, PayloadLen=90, Seq=935738026
2661 140.1408731 10.10.10.10 10.10.10.22 TDS:SQLBatch, Version = 7.300000(No version information available, using the default version),
2662 140.1408747 10.10.10.10 10.10.10.22 TCP:[ReTransmit #2661]Flags=...AP..., SrcPort=38080, DstPort=1433, PayloadLen=46, Seq=372244528
2663 140.1409064 10.10.10.22 10.10.10.10 TDS:Response, Version = 7.300000(No version information available, using the default version),
2664 140.1409077 10.10.10.22 10.10.10.10 TCP:[ReTransmit #2663] [Bad CheckSum]Flags=...AP..., SrcPort=1433, DstPort=37768, PayloadLen=48
2665 140.1409720 10.10.10.22 10.10.10.10 TDS:Response, Version = 7.300000(No version information available, using the default version),
2666 140.1409733 10.10.10.22 10.10.10.10 TCP:[ReTransmit #2665] [Bad CheckSum]Flags=...AP..., SrcPort=1433, DstPort=38080, PayloadLen=37
2671 140.1410158 10.10.10.10 10.10.10.22 TDS:SQLBatch, Version = 7.300000(No version information available, using the default version),
2672 140.1410165 10.10.10.10 10.10.10.22 TCP:[ReTransmit #2671]Flags=...AP..., SrcPort=47962, DstPort=1433, PayloadLen=90, Seq=15608618
2677 140.1414667 10.10.10.10 10.10.10.22 TCP:Flags=...A...., SrcPort=38080, DstPort=1433, PayloadLen=0, Seq=3722445334, Ack=3471897492,
2678 140.1414677 10.10.10.10 10.10.10.22 TCP:[Dup Ack #2677]Flags=...A...., SrcPort=38080, DstPort=1433, PayloadLen=0, Seq=3722445334, A
2687 140.1415797 10.10.10.10 10.10.10.22 TDS:SQLBatch, Version = 7.300000(No version information available, using the default version),
2688 140.1415806 10.10.10.10 10.10.10.22 TCP:[ReTransmit #2687]Flags=...AP..., SrcPort=50706, DstPort=1433, PayloadLen=46, Seq=378432362
2689 140.1416609 10.10.10.10 10.10.10.22 TDS:RPCRequest, Version = 7.300000(No version information available, using the default version)
2690 140.1416619 10.10.10.10 10.10.10.22 TCP:[ReTransmit #2689]Flags=...AP..., SrcPort=38080, DstPort=1433, PayloadLen=431, Seq=37224453
2691 140.1416680 10.10.10.22 10.10.10.10 TDS:Response, Version = 7.300000(No version information available, using the default version),
2692 140.1416693 10.10.10.22 10.10.10.10 TCP:[ReTransmit #2691] [Bad CheckSum]Flags=...AP..., SrcPort=1433, DstPort=50706, PayloadLen=37
2695 140.1417403 10.10.10.22 10.10.10.10 TDS:Response, Version = 7.300000(No version information available, using the default version),
2696 140.1417416 10.10.10.22 10.10.10.10 TCP:[ReTransmit #2695] [Bad CheckSum]Flags=...AP..., SrcPort=1433, DstPort=38080, PayloadLen=18
Frame 2632 is a retransmission of 2631, 2634 is a Duplicate Ack of 2633, etc. Every packet is retransmitted once exactly.
This does not indicate a network issue but a capture issue. For example, if capturing the input traffic and the output traffic on a network device and the two captures are merged into one file. Port mirroring and having teamed NIC cards can sometimes show this pattern. Also, capturing at two different levels of the network stack or capturing at a network gateway and getting traffic from both subnets it is connected to.
To correct, try to capture only the input or output traffic, or capture only a single source on the machine rather than all sources.