Transcription
SharkFest ’18 ASIATCP Selective Acknowledgement correctly interpreting this field can helpyou be a better performancetroubleshooter John PittleGlobal Architect, PerformanceManagement ServicesRiverbed asia NEC,NEC, NanyangNanyang TechnologicalTechnological University,University, SingaporeSingapore AprilApril 9-119-11
My Agenda Relevant RFCs Review TCP ACK Basics SACK Introduction SACK Decode Details SACK Example Illustration Adventures from the Field - Visualization Replay Wrap-Up#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Your Agenda Learn more about TCP SACK and how it relates toOut of Sequence Packet arrival Learn more about how OOS impacts applicationperformance Learn about the Wireshark display fields that canhelp you#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Related RFCs RFC 793 – TCP (Original RFC – 1981) RFC 2018 – TCP Selective ACK Options (1996) RFC 2883 – An Extension to SACK (2000)#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Review: TCP ACK Behavior As long as packets arrive in the expected order,receiver will ACK every other packet (DefaultBehavior) If a packet arrives out of order, the receiver willimmediately issue an ACK with a value equal tothe SEQ that was expected#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Review: TCP ACK Behavior Receiver will continue to ACK every packet untilthe expected packet is received If sender receives 4 ACKs with the same ACKnumber (aka Triple Duplicate ACK) he willretransmit the missing segment Assumes TCP Fast Retransmit & Recovery (FRR) is available andenabled#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Cumulative ACK (RFC 793)The ACK in the TCP header is called the “Cumulative ACK”. Thevalue reflects stream bytes received in order up to the point when theACK packet was transmitted.Receiver’s TCP declares that all bytes in the stream up to ACK-1 havebeen received. The next byte of TCP stream expected by the receivershould start with a SEQ equal to this ACK.#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Selective ACK – A TCP Enhancement RFC 2018 proposed an enhancement to the TCPACK mechanism Selectively acknowledge segments that havearrived out of order The sender won’t have to retransmit those segments ifhe knows they’ve been received But, this can’t be accomplished with Cumulative ACKfield alone, so a new field is needed#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Selective ACK – A TCP Enhancement New addition to the TCP Options field of the TCPheader Up to four (4) contiguous out of ordersegments/segment ranges can be defined usingSACK Only three (3) if the TCP Timestamp option is also beingused#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Enabling SACK On by default in modern TCP Stacks SACK is negotiated at connection start-up Decode the TCP Options in SYN and SYN ACKand you’ll see “SACK Permitted” Meaning ”I will process the SACK field if you send it to me” Each side can independently chose#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Intended Benefits Better intelligence about packet delivery available tosender Positioned to minimize the amount of unnecessaryretransmissions Will not necessarily change Congestion Control algorithms Any retransmission may still have a negative effect on theCongestion Window and related timers#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Use during packet analysis Manually interrogating the SACK fields will giveyou a perspective of “how bad” is “bad” Use “Bytes in Flight” as a guiding metric If in-flight data stays high no need to look anyfurther If in-flight data constantly dips or hits zero; or youfrequently see TCP slow-start, you may find theroot cause is severe out of sequence packets#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Do you remember this?#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Wireshark is SACK Aware Wireshark decodes the SACK fields in the TCPOptions section of the TCP layer SACK Count and Left Edge / Right Edge values canbe displayed as columns in the decode summarysection If you capture on sender you’ll see retransmissionsand DupACKs If you capture on receiver you’ll see DupACKs andOOS#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Wireshark ColumnsAll bytes through 14770r have beenreceived and I’m ready for 14771r.But wait there’s more .#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Wireshark ColumnsAll bytes through 14770r have beenreceived and I’m ready for 14771r.But wait there’s more .I’ve also received one or moresegment(s) out of order:17619-19042r.What’s missing?14771-17618rUniversity, Singapore April 9-11#sf18asia NEC, Nanyang Technological
Example with two blocks OOS#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Example with two blocks OOS#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
A Different Wireshark Profile#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Edit “Occurrence #” Right mouse click on column header Select “Edit Column”#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Pop Quiz What’s one of the best things about Wireshark? OK , besides the Developers? Totally flexible columns, views, and profiles!!#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Time for an Illustration #sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Illustration #1 Sender transmits a burst of 5 packets as follows: Pkt 1 SEQ 11 Len 10 Pkt 2 SEQ 21 Len 10 Pkt 3 SEQ 31 Len 10 Pkt 4 SEQ 41 Len 10 Pkt 5 SEQ 51 Len 10#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Illustration #1 Due to a network issue, the packets are receivedin the following order: Pkt 1 Pkt 2 Pkt 4 Pkt 5 Pkt 3#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #11st two packets arrive11 - 30#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #11st two packets arrive11 - 30Packet 4 arrives11 - 30Left Edge 4141-50Right Edge 51#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #11st two packets arrive11 - 30Packet 4 arrives11 - 30Left Edge 4141-50Right Edge 5111 - 3041-60Packet 5 arrivesRight Edge 61#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #11st two packets arrive11 - 30Packet 4 arrives11 - 30Left Edge 4141-50Right Edge 51Packet 5 arrives11 - 3041-6011-60Right Edge 61Packet 3 arrivesAll data received up through and including byte 60#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver Side TCP Mechanics#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver’s ACK responses Pkt 1 Arrives, receiver starts delayed ACK timer,waits for a 2nd packet#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver’s ACK responses Pkt 2 Arrives, receiver cancels delayed ACK timer,sends: ACK 31#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver’s ACK responses Pkt 4 Arrives , but wait!, it’s out of order receiver issues immediate ACK because #sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver’s ACK responses the packet we just received is out of order Here’s the ACK and SACK info ACK 31 SACK 41-51#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver’s ACK responses Pkt 5 Arrives but it’s also out of order, receiverissues another immediate ACK because packet isout of order ACK 31 SACK 41-61 **Note: at this point TCP stack is holding up to 2 packets in thereceive buffer ***#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver’s ACK responses Pkt 3 Arrives, receiver issues: ACK 61#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Receiver’s ACK responses Pkt 3 Arrives, receiver issues: ACK 61 Order is restored to the Force #sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Another Example, Slightly More Complicated Sender transmits a burst of 6 packets as follows: Pkt 1 SEQ 11 Len 10 Pkt 2 SEQ 21 Len 10 Pkt 3 SEQ 31 Len 10 Pkt 4 SEQ 41 Len 10 Pkt 5 SEQ 51 Len 10 Pkt 6 SEQ 61 Len 10#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Another Example, Slightly More Complicated Due to a network problem, the packets are received in the following order: Pkt 1 Pkt 3 Pkt 6 Pkt 4 Pkt 5 Pkt 2#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #2Packet 1 arrives11 - 20Start Delayed ACK Timer #sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #2Packet 1 arrivesPacket 3 arrives11 - 2011 - 20Start Delayed ACK Timer 31-40ACK 21 SACK 31-41#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #2Packet 1 arrives11 - 20Packet 3 arrives11 - 20Packet 6 arrives11 - 20Start Delayed ACK Timer 31-40ACK 21 SACK 31-4131-4061-70ACK 21 SACK 31-41, 61-71#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #2Packet 1 arrives11 - 20Packet 3 arrives11 - 20Packet 6 arrives11 - 20Packet 4 arrives11 - 20Start Delayed ACK Timer 31-40ACK 21 SACK 31-4131-4031-5061-70ACK 21 SACK 31-41, 61-7161-70ACK 21 SACK 31-51,61-71#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #211 - 20Packet 5 arrives31-70ACK 21 SACK 31-71#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Pop Quiz11 - 20Packet 5 arrives31-70ACK 21 SACK 31-71How many packetsare in sender’sretransmit queue?#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Pop Quiz11 - 20Packet 5 arrives31-70ACK 21 SACK 31-71How many packetsare in receiver’squeue?#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Visualization #211 - 2031-70Packet 5 arrivesACK 21 SACK 31-7111-70Packet 2 arrivesACK 71#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Questions / Discussions#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Firewall Effects Some firewalls will randomize the starting TCPSYN sequence number when new connections arecreated The receiver only knows the randomized versionof the sequence numbers generated by theFirewall#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Firewall Effects When receiver creates ACKs with SACK values, theSACK sequence numbers will not match thesequence numbers in the TCP header known bythe sender Firewall will always restore the original sequencenumbers in the TCP header only but no guarantees for translating the SACK field This generally makes the SACK field unusable for thesender#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Example of Firewall SEQ SACK sequencenumbers bare no resemblance toRandomizationthe SEQ or ACK in the TCP header#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Example of Firewall SEQ Zoom in fromRandomizationprevious slide#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Adventures from the Field#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Adventures from the Field Next we’re going to look at actual results from atroubleshooting engagement involving crazy highlevels out of sequence packets Not just high levels of OOS, but crazy high #sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Lab ConfigurationMGMT ZonePublic : Client Downloading OS Configuration Build Details from ServerWireshark Capture Sources#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Non-Technical Issues Finger pointing to the extreme each vendor (3) is sure they are innocent andthat it was the other vendor’s issue Challenge: Help Customer figure out whythroughput is so low, and help identify the vendorcausing the problem#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet Captures Wireshark host captures Laptops each getting a SPAN feed One on “internal” side of the IPS in the MGMT Zone One on “internal” side of the IPS in the Public Zone#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Summary of Delays#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
In-flight Data Analysis#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Zoom #1 - In-flight Data Analysis#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Zoom #2 - In-flight Data Analysis#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Zoom #3 - In-flight Data Analysis#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Questions / Discussion#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
OOS Visualization SACK Analysis The following section uses time lapse photographyto step you through a 19 packet burst chosen atrandom The number, and nature, of out of sequencepackets is crazy high and it’s a nice example toillustrate how to interpret the SACK field#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
ACK Packets Corresponding to a Packet Burst These are the ACKs from the client#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
ACK Packets Corresponding to a Packet Burst Each ACK corresponds to one (or more) of the19 packets in our random sample We’ll use these ACKs to determine the arrivalorder for the 19 packets#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Before we start . a quick Pop Quiz:1. Why are there so many ACKs, I thought receiver is supposed toACK of every other packet?#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
2. Why does the ACK packet size change between 66, 78, 86, and94?#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
3. Why is the receive window continuing to shrink?#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
4. Why do we see so many duplicate ACKs?#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Questions / Comments#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Pre-departure Orientation 19 Slide Journey The top portion of the slide shows you whichpacket in the burst has been received The bottom portion shows you the ACK and SACKvalues extracted from the corresponding ACKpackets Each slide represents a new packet being receivedand the state of all previously received packets#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
OrientationMgmt FrameLast Byte#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
OrientationMgmt FrameLast ByteThis is the frame order asseen in the Public capture(closest to Receiver)#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
OrientationThis is the frame order as seen in theMgmt capture – traffic in transit to Public(closest to Sender)Mgmt FrameLast ByteThis is the frame order asseen in the Public capture(closest to Receiver)#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
OrientationThis is the frame order as seen in theMgmt capture – traffic in transit to Public(closest to Sender)Mgmt FramePacket Just ReceivedBracketed in RedLast ByteThis is the frame order asseen in the Public capture(closest to Receiver)#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
OrientationThis is the frame order as seen in theMgmt capture – traffic in transit to Public(closest to Sender)Mgmt FramePacket Just ReceivedBracketed in RedLast ByteThis is the frame order asseen in the Public capture(closest to Receiver)Frames previously receivedbracketed in Green#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
ACK Details for each packet receivedMgmt FrameLast ByteThis is the TCP Header from ACKPacket’s Decode Summary#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
ACK Details for each packet receivedMgmt FrameLast ByteThis is the TCP Header from ACKPacket’s Decode SummaryThis is the value of the SACK fromTCP Options Field#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Ready to start our Wild Ride .? Fasten your seat belt. Double check your understanding, ask if whatyou’re seeing makes sense. Prior to the start of this sequence, receiver hadsignaled that he’s ready to receive the streamstarting at byte:Focus on the Cumulative ACK values and the SACKvalues as each packet is received.1,085,576,095#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
1st Packet ReceivedMgmt FrameLast ByteAfter receipt of the above packet (in Red), the receiver issued the following ACK#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
2nd Packet ReceivedMgmt FrameLast ByteAfter receipt of the above packet (in Red), the receiver issued the following ACK#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
3rd Packet ReceivedMgmt FrameLast ByteNotice the cumulative ACK hasincreased to a value of 1085577543SACK Field has not changed#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
4th Packet ReceivedMgmt FrameLast ByteRight edge changed#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
5th Packet ReceivedMgmt Frame#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #6Mgmt Frame#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #7Mgmt Frame#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #8Mgmt FrameSACK now represents three segment groups#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #9Mgmt Frame#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #10Mgmt Frame#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #11Mgmt Frame#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packets #12 13Mgmt Frame#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #14Mgmt FrameNotice that two of the dis-contiguousblocks are now contiguous; so we gofrom 3 blocks down to 2 blocks#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #15Mgmt FrameNotice the cumulative ACK has increased toa value of 1085592023 and we’re down tojust one dis-contiguous block#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #16Mgmt FrameLeft edge updated to reflect packet #16#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #17Mgmt FrameCumulative ACK is updated to reflect receipt of #17No change to SACK fields#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #18Mgmt FrameRight edge updated to reflect packet #18#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Packet #19Mgmt FrameNew cumulative ACK reflects receipt of all 19 packets(Plus, packet 20 not shown in the list .)#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
After packet 19Mgmt FrameIt’s been a long, strange journey, but all data has finally been received#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Buffer Mgmt Issues? FIFO?LIFO? IFFY? #sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Questions / Comments#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Outcome from this Study Client was very pleased that we could help themunderstand the full extent of the OOS problem Showed that packets are not “just a little out ofsequence” but significantly out of sequence Definitely impacted sender’s ability to maintain a largecongestion window Client re-evaluated plans to deploy more IPS devices#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Outcome from this Study Client shared results with their IPS vendor whichtriggered a major investigation into stream andbuffer management in the IPS#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Outcome from this Study A few months later we tested a new model of IPSin Client’s lab Some improvement but still a problem even at lowthroughput levels#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Cause and Effect#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Review: Effect of the OOS on the sender Potential Throughput Killer: Will likely trigger TCPcongestion window reduction if he has toretransmit Dependent on the OS and patch level of thesender and possibly the NIC driver (maybe) The RFC for SACK has a lot of “should”s and“may”s. The implementer is allowed a lot flexibility in how they handle theSACK information provided by the receiver#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Effect of the SACK field on the sender Consider: should the sender retransmit just onemissing segment, or if he can see from the SACKthat lot’s of different packets are missing shouldhe retransmit all of them Also, sender has to maintain all packets in theretransmit queue until they’ve been ACK’d,possible stress on memory#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Effect of out of sequence arrivals on thereceiver He has to buffer all out of sequence packets Can not deliver any discontinuous stream bytes tothe app until all missing packets are received Will generate more ACKs – one for each OOSpacket received What happens if there are lots of gaps? Remember SACK can only record up to 4 gaps (3 if timestampoption is also being used)#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Effect of out of sequence arrivals on the receiver Receiver is allowed to “reneg” if he runs out ofbuffer space#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Effect on Sender’s NIC What if TSO is enabled? What if TCP Chimney is enabled (Windows)? Who is managing the retransmit queue the TCPStack on the OS or the NIC? I pose these questions because they might beimportant. The specific NIC brand, driver version, and firmwareversion may impact answers to the above.#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Effect on Sender’s ESX Host NIC What if TSO is enabled on the Physical NIC? Who is managing the retransmit queue the TCPStack on ESX, NIC, OS or the vNIC? The specific NIC brand, driver version, and firmwareversion may impact answers to the above.#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Reminders You can quickly determine presence of SACK inWireshark using a “tcp.options.sack.count” displayfilter You can easily add SACK related columns toWireshark GUI#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
SACK Wireshark ColumnsAll bytes through 14770r have beenreceived and I’m ready for 14771r.But wait there’s more .#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
A Different Wireshark Profile#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Reminders Firewall sequence number randomization canrender SACK unusable by the sending host Result no benefit from SACK#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Closing Remarks Focus on “Bytes in Flight” Data If you see the congestion window constantly closing or reduced byhalf, then you need to figure out why Interpreting SACK might help complete the picture It’s easy to get lost drilling in to SACK fields It’s prudent to interpret some of them and make ahigh level assessment as to the extent of OOSpackets To interpret them you have to understand the RFC and expectedbehavior#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Closing Remarks If you have a lot of SACKs with 3 or 4 gapsdeclared, then OOS is “high” / “pervasive” If you have a few SACKs with only 1 gap each,then OOS may be less of a contributing factor#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
End of Session#sf18asia NEC, Nanyang Technological University, Singapore April 9-11
Wireshark is SACK Aware Wireshark decodes the SACK fields in the TCP Options section of the TCP layer SACK Count and Left Edge / Right Edge values can be displayed as columns in the decode summary section If you capture on sender you’ll see retransmissions and DupAC
