What is the reason for the sudden drop in download speed? It's probably TCP retransmissions that are being patched up behind the scenes. I captured the packets and counted them.

Last month, I downloaded a 2G system image in my company. The first minute was a steady 28MB/s, and I finished the job in two minutes at this speed. As a result, it dropped to 3MB/s in the second minute, and the web page started to spin in circles. I thought my colleague had blocked the BT. I cursed and restarted the router, to no avail. Later, when I pressed F12 on the browser, I saw a row of RTOs in the network column. The numbers were terrifyingly large - it was TCP that was helping me patch the files. The more patches were patched, the slower the speed.

I later encountered this incident twice at home. Once, my mother used her mobile phone to watch the live broadcast on the balcony, and another time, half of the network cable was gnawed by mice. The root cause of the disease was different three times, but the symptoms were the same.: The speed is cut in half, the web page rotates in circles, and the voice is okay. This article will explain clearly what TCP retransmission is, how to measure it yourself, and what to fix after measuring it.

Make it clear first: Retransmission is TCP’s fire brigade, not the fault itself

Each data packet sent by TCP is numbered, and the other party receives a receipt for each packet. The sender stares at these receipts. If the receipt for any packet is delayed, he will send that packet again - this action is called retransmission. There are two ways to trigger it: One is "You have waited enough time." The jargon is called RTO timeout. The literal meaning is "If you wait any longer, the day lilies will be cold." Direct reissue. ； The other one is "received three duplicate confirmations", which means that the other party is shouting "I am missing package No. 541, and all the following ones are blocked." The sender does not need to wait for timeout, and immediately makes up for it - this fast path has a name called fast retransmission.

So retransmission itself is not a disease, it is TCP taking care of it for you. When you usually browse the web, you have never seen half of a picture missing. It’s this patching mechanism at work. The real problem is that when the packet loss rate becomes high, TCP will change from "repairing one piece occasionally" to "repairing one piece every day." Each time a packet is replenished, it means that this section of the road has to be run back and forth in vain, and the speed will naturally be slowed down.

For example, if you lose one of the ten items you purchased online, and the courier secretly reissues it, you won’t be interested. ； If you lose six pieces, the courier will be on the way to re-delivery every day, and your arrival will be half as fast. This is how the download speed was cut in half - the road is still the same, and half of the capacity is wasted on rework. Why does TCP go to so much trouble to sign receipts? What is the difference between TCP and UDP I used registered mail as an example here, but I forgot to read that article first.

How to measure yourself: Two roads, no need to guess a single number

Just guessing is useless, let me tell you two things I often knock on.

The first is browser F12. Press Open, switch to the "Network" tab, refresh the page, and click on a large request. You can find RTT and RTO in the timing or connection information. RTT is how long it actually takes for a round trip, and RTO is the threshold of "how long to wait until there is no response". RTT displays 30ms, RTO displays 200ms, normal ； The RTT has drifted to 80ms and the RTO has soared to more than 1000ms. This link is losing packets. TCP has waited longer and longer for timeout and has become more and more conservative. What does each column of F12 mean? What does F12 mean? There is a column-by-column translation.

The second thing is three pings. Open three windows and ping the gateway respectively ( 192.168.1.1 ), public network DNS ( 114.114.114.114 ), and the domain name of the site to be downloaded, each run one or two hundred packages. Look at two: The percentage of the packet loss rate line, and the fluctuation range of time. The gateway section is missing, the blame lies at home. ； The gateway is not lost, the public network is not lost, the fault lies with the operator. I'm using this positioning method How to troubleshoot WiFi packet loss rate I have already written it here, just follow it step by step. What does the ttl line in the ping output mean? What is TTL As I said by the way, don’t treat it as a delay.

My judgment is based on a table:

This kind of behavior is the easiest to get confused. Ping only sends small packets of 32 bytes. A hundred complete packets cannot explain the large packets - the packet loss rate is related to the size of the packet. Fully loaded large packets are more likely to be squeezed out on the road. Therefore, if the ping is not lost but the speed is still dropped, suspect other places first. How to measure broadband speed accurately There are correct speed measurement postures.

Why does it feel like there is a speed limit when my speed drops?: Slow start this account

There is another strange phenomenon worth talking about: After the packet loss is restored, the speed does not immediately bounce back to 28MB/s, but slowly climbs back up like a hill. This is not a stuck, but a self-protection action of TCP.

The rate at which TCP sends data is not achieved in one step. It first tries to send a little bit, then doubles it if it is not lost, then doubles it if it is not lost, until it reaches full speed. This period is called slow start. Once a retransmission occurs, especially a timeout retransmission, TCP will determine that "this road is crowded" and immediately cut the rate to a very low level and start again. The speed curve you see is: It dropped to 3MB/s, and then climbed back section by section at 5, 9, 14, and 20. Each climb in the middle corresponds to a back-and-forth confirmation.

So short connections suffer the most. It only takes a few hundred kilobytes to transfer a web page. The transfer may be completed as soon as it reaches the high speed, and the entire process is in the low speed zone. ； The disadvantage of downloading large files is that you have to crawl it again every time you lose a packet. When I downloaded the image, I watched the speed curve in the task manager go up and down like sawtooths - the bottom of each sawtooth is a retransmission and acceleration. If you want to see how much this link has been lost, tracert will show the path hop by hop to make it more intuitive. What does each hop of tracert mean? I ran it through my own broadband here.

I will rank the four suspects in this section of my family according to their probability.

The measurement shows that packets are lost in the gateway section, or packets are lost in the WiFi section. Check in this order. Basically, all the three times I stepped on the trap were in it.:

• Network cable ： Being pinched by a door, oxidizing the crystal head, or eating half of the bark from a mouse will cause the link to run away and be lost. Look at the computer network card negotiation speed. If the Gigabit port is negotiated as 100M, there is something fishy. I later bought a Category 6 cable and replaced it and it worked immediately. When I cut the old cable, I found that the third pair of cables was almost broken. If the Gigabit speed is not enough, don’t blame the router first. What is the difference between Category 5e and Category 6 network cables? I cut three of them and compared them.
• WiFi signal ： -In corners below 75dBm, retransmission queuing costs double, and the speed first cuts in half and then circles around. Moving the router or adding a Mesh node is more effective than changing the router.
• interference and channel ： The 2.4G WiFi throughout the building was crowded into three non-overlapping channels during the evening rush hour, and the neighbor turned on the microwave and the situation worsened. For 2.4G, look for numbers 1, 6, and 11, and move all 5G equipment there.
• Router overloaded ： When the number of connections is full, the CPU is occupied by QoS or parental control, and the forwarding itself is lost. Go to the background and check the CPU and session count. I couldn’t open any web pages that night when I connected to BT. This is why. What happens when the number of router connections is full? I have calculated this account.

Of the four, the network cable is the most unfair, because it is the least like the suspect - the link indicator light is on, and the Internet can be accessed, but packets are secretly lost. There is only one way to judge: Look at the network card negotiation rate and packet loss rate. If the negotiation rate drops for no reason, it is probably a line problem.

The gateway is not lost, the public network is lost: Don't mess around with yourself

If the three-stage ping measurement is down, gateway 0 is lost, 114.114.114.114 If you lose 6%, it will be useless no matter what you do at home. The blame lies with the operator. Congestion in the evening peak area is the hardest hit area, and the performance is: 28MB/s during the day, 3MB/s dropped at 8pm, and I was fine the next morning. There is basically no need to suspect the equipment at home for this kind of periodic slowdown. What is the normal game ping value? There is a delay tier table for intra-provincial nodes and cross-border delays. You can check which section you are stuck in.

Prepare all the evidence before reporting for repair: Three screenshots of ping, one speed record each at evening peak and off-peak, and light attenuation readings (you can see it in the backend of Light Mode, and it is considered normal if it is within -28dBm. I wrote about this in the light attenuation article). With the numbers in hand, the master can come to your home and measure the line directly, eliminating the need for back and forth. By the way, the speed test results should be calculated separately from the bandwidth and negotiated speed. Mixing the three accounts together will never lead to a clue. Why is the Gigabit Broadband WiFi speed test only 600 Mbit/s? I have discussed these three accounts separately.

There is another situation, don’t take the wrong route: The download source itself has a speed limit. Some servers provide 3MB/s to free users. If you change the source, the speed will be full immediately. The judgment method is very simple. Use two different download sources and test each one. If both sources are slow, it is the fault of the line.

ending: Go in this order, don't take detours

Divide the entire set of movements into five steps. I did it this way three times.:

1. F12 Take a look at the RTO and RTT to confirm that it is link packet loss and not another problem.
2. Three-stage ping positioning: The gateway is left at home, and the public network is left at the operator.
3. The home section is arranged one by one according to the four suspicions of network cable, signal, channel, and router load.
4. If the gateway is not lost, prepare evidence to report it for repair. Be sure to keep the evening peak data.
5. If you are still not at ease, try another download source and test again to eliminate the source speed limit.

wrap up: The good thing about the TCP retransmission mechanism is that you don't feel its existence at all. The bad thing is that once it senses its presence, all the symptoms you see - speed cut in half, web pages spinning, jagged speed curves - do not point to the real culprit. Next time your download speed suddenly drops by half, press F12 first. Don’t rush to restart the router, let alone scold the operator.