Interpret Wireshark Captures

Question

I am troubleshooting wireless connectivity problem in my home network. My Thinkpad X200 laptop which use Intel Wifi Link 5100 AGN is not able to surf the internet stably. Sometimes it works, but most of the time it couldn't load the page completely or not loaded at all.

This is not happening to my desktop PC which is connected to the same D-Link AP as well.

I managed to capture network traffic on my laptop with Wireshark which results in the image below:

From what I know, the black-background rows show that there are erros in TCP checksum / Bad TCP. Is this normal on any wireless network? If not, how can I fix my laptop so it can surf the internet stably as my desktop PC?

Edit: I tried to capture the TCP packet again while the page failed to completely load. It looks like this is related to massive "TCP Retransmission" in Wireshark logs somehow ..

Edit 2: Gave up on investigating this. Tried another ACP. Luckily, it works without those many retransmission message o__o' Many thanks to everyone for the answers!

Solution 1

TCP checksum / Bad TCP is very normal for Wireshark and other packet sniffing tools, it is because you have enabled the checksum offloading on your wireless card, you can disable it or ignore it.

TCP retransmission is the exact reason for the problems of your network.

The possible reasons are below:

• The acknowledgment packets are being transmitted via a slower path.
• The network load is very high.
• The receiver or router is overloaded.

Solution 2

Intel's Centrino WiFi adapters that are usually in the X200 are generally OK but they have had issues with Power Management (CAM\PSP) WiFi features when connecting to some AP's. As a first step I'd suggest you go into the properties of the WLAN adapter and disable power management and under the advanced properties set the Transmit power to max.

Solution 3

The bad checksum errors are probably because you have TCP offload facilities in your network card. What this means is that the checksum is calculated after Wireshark has captured the packet.
There is a page abput it in the Wireshark FAQ.

EDIT: In response to the comments, it is probably not the source of the issue. If the checksum was incorrect when the packet arrived at the destination then it would request a re-send. However, i would suggest following the recommendation in the Wireshark documentation and turn off checksum offloading while you are running a trace. On a modern PC that is only doing normal desktop tasks, I doubt you will notice any performance difference so it is probably easier to just leave it turned off until you get this problem fixed. (Or you give up investigating it.)

Comments

[Helvick]

Is the desktop also using a Wireless Connection or is it wired?

[m3rLinEz]

@Helvick The desktop is using wireless connection too.

[m3rLinEz]

Thanks for the info! I disabled power mgmt and also update the driver to latest version. Still not see any single hiccup this morning.

[m3rLinEz]

Thanks for this. Does this means the actual packets are okay but Wireshark just reports them as corrupted?

[Arjan]

@m3rLinEz it actually means that Wireshark cannot tell. But most likely they are okay indeed. Then again: you're investigating connectivity problems, so maybe you're onto something here. Ensure that the specifications of your wireless network card indeed support checksum offloading before ignoring the errors (or before changing the preference as mentioned in the Wireshark FAQ that pipTheGeek gave you). Alternatively, see if you can disable that function in the settings of your wireless network card.

[m3rLinEz]

Sadly, it's still not working .. I also tried to capture TCP packet during the time problem occur and it looks like this is related to TCP Retransmission somehow ..

[Anonymous Type]

good ol tcp retrans