How does the DNCA handle duplicate TCP packets
Only TCP packets within the TCP connection are checked against their TCP sequence numbers. Duplicates are determined based on TCP sequence numbers.
While DNCA processes can handle duplicate traffic packets, they represent an unnecessary usage that can impact performance when the system approaches to its maximum performance level. The submission of duplicate packets to DNCA must be curtailed whenever possible.
At the TCP packet level, the Unica Discover Network Capture Application checks for the presence of duplicate packets in a TCP connection. DNCA does it by evaluating their TCP sequence numbers. When duplicates are detected, they are handled in the following ways:
- If two packets is displayed back-to-back in the same connection, the second packet is discarded.
- If two packets is displayed in the same connection, contain a repeated sequence number, but do not is displayed back-to-back, the second packet is discarded.
- If sources and destinations of the packets are distinct, the packets are accepted by the DNCA and reassembled for delivery to downstream canisters.
Through the Statistics tab of the DNCA Web Console, you can monitor the frequency of duplicated TCP packets. Following is the the key statistic to monitor:
Total back-to-back duplicate packets
In the stats.xml file, this statistic is displayed
as:
<TcpTotalDuplicatePackets>
A high number of duplicate packets can indicate that the network
switch span ports are not properly configured. For example, if the
number of duplicate packets approaches one half of the value specified
in the Total packets rcvd value statistic. It also
indicates that ports are submitting duplicate traffic to the Unica Discover Network Capture Application server.
See Stats per Instance.