On 2014-05-24 23:19, Jean-Yves Bernier wrote: At 10:26 PM +0200 24/5/14, Johnny Billquist wrote: If I were to guess, there are packets dropped. I can see the segment counter running backward at times, like this: 23:15:56.109519 10.2 > 10.1 586 data 45058>40193 seg 18 23:15:56.109855 10.2 > 10.1 378 data 45058>40193 seg 19 23:15:56.110118 10.2 > 10.1 586 data 45058>40193 seg 20 23:15:56.110277 10.2 > 10.1 586 data 45058>40193 seg 21 23:15:56.110548 10.2 > 10.1 586 data 45058>40193 seg 22 23:15:56.110736 10.2 > 10.1 364 data 45058>40193 seg 23 23:15:56.196612 10.2 > 10.1 586 data 45058>40193 seg 24 23:15:56.196816 10.2 > 10.1 586 data 45058>40193 seg 25 23:15:56.197113 10.2 > 10.1 586 data 45058>40193 seg 26 23:15:56.197316 10.2 > 10.1 394 data 45058>40193 seg 27 23:16:06.113164 10.2 > 10.1 586 data 45058>40193 seg 20 23:16:06.113458 10.2 > 10.1 586 data 45058>40193 seg 21 23:16:06.113664 10.2 > 10.1 586 data 45058>40193 seg 22 23:16:06.113994 10.2 > 10.1 364 data 45058>40193 seg 23 23:16:06.114152 10.2 > 10.1 586 data 45058>40193 seg 24 23:16:06.114304 10.2 > 10.1 586 data 45058>40193 seg 25 23:16:06.114657 10.2 > 10.1 586 data 45058>40193 seg 26 23:16:06.117048 10.2 > 10.1 394 data 45058>40193 seg 27 I sdon't know how good the tcpdump DECnet parsing is. I would prefer to look at the counters in DECnet instead. But this would seem to suggest that you have retransmissions as well, yes. Johnny -- Johnny Billquist || "I'm on a bus || on a psychedelic trip email: bqt at softjar.se || Reading murder books pdp is alive! || tryin' to stay hip" - B. Idol