Hacker News Reader

Comment by euph0ria | Hacker News Reader

Why not just use tcpdump or wireshark when troubleshooting network latencies? Usually only takes a minute or two to pinpoint the issue. Then you would need to spend time understanding why the pinpointed behavior is what it is and sometimes it is in the application, sometimes not.. I've solved so many issues over the years with tcpdump that it has become one of the most valuable tools I know.

View on HN

Out of curiosity, how would you debug this issue with Wireshark?

Just look for multiple messages in a single TCP packet? Or is there a better way?

Right? If seeing multiple messages in a single TCP packet immediately clues you in to the issue, the truth is that you already knew about the issue.

No kidding. I imagined Google or DDG would turn "multiple messages in a single TCP package" into something useful, since it's basically the description of the algorithm. But no luck. The best I got was somebody with an IO buffering problem in Stack Overflow that commented that he turned the algorithm off.

If you're debugging weird latency problems, I'd recommend to start from relative timestamps. Then filter to just one or two TCP streams that exhibit the problem and go from there.

Inspect packet contents. The packet dissectors are doing a lot of heavy lifting, so look at the deconstructed data. I realise this may not be a welcome suggestion, but a sharp pencil, an A3 (or larger) scratch pad and a good ruler go a long way.

I've dug to the bottom of quite a few network and traffic problems in my life by drawing the observed traffic patterns into sequence diagrams. Once you have the diagram visualised, it's easier to spot the places where something funky either happens or looks to be missing.

Well, as soon as you'd look for and find any one of your messages in wireshark to use as an example, then you'd notice that the packet has not only that message but others as well.

Can anyone recommend a good intro to debugging network problems assuming competent knowledge of most Linux sysadmin tasks?

We're about to wrap up a conference dedicated to that very subject: https://sharkfestvirtual.wireshark.org/. Session videos should be online soon.

Reply on news.ycombinator.com