highAdvancedUSE#retransmission#packet-loss#syn#tcp#mtr

High SYN retransmissions -- packet loss on the network path

netstat shows high RetransSegs counter increasing rapidly

Likely source:connectivityperformance

Focused incident mode — strips away everything but this runbook.

Symptoms

  • netstat shows high RetransSegs counter increasing rapidly
  • Connections take multiple seconds to establish due to SYN retransmits
  • mtr or traceroute shows significant packet loss at intermediate hops

mtr loss at an intermediate hop that doesn't increase toward the destination is usually ICMP rate-limiting, not real packet loss. Focus on the final hop's loss percentage.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • TCP retransmission counter

    ss -ti | grep retrans

  • Path loss measurement

    mtr -rw <SERVER>

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • mtr shows consistent loss at a specific hop
  • Loss increases toward the destination

Confirm before fixing

mtr -rw <SERVER> && ethtool <INTERFACE> | grep -i 'error|drop'
READ

Check for interface errors that indicate physical problems

Fix

echo 'Check the physical link (cable, switch port, NIC) at the hop with loss.'
READ

Document the physical inspection fix

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
mtr -rw -c 100 <SERVER>
READ

Identify where loss is occurring on the path

2
ss -ti | grep -E 'retrans|rto|rtt'
READ

Check TCP retransmission stats

3
tcpdump -i any 'tcp[tcpflags] & (tcp-syn) != 0' -c 30 -nn host <SERVER>
READ

Capture SYN retransmissions

4
sysctl -w net.ipv4.tcp_congestion_control=bbr
CHANGE

Switch to BBR if congestion control is the issue

Prevention

  • Deploy mtr/iperf3 monitoring between critical service pairs.
  • Enable BBR congestion control on all Linux endpoints.
  • Monitor interface errors (ethtool) and switch port stats for physical issues.
  • Set up network path monitoring for all production-to-production traffic paths.

Related runbooks

Same stack, same failure family — worth a skim.

PMTU blackhole -- large packets silently dropped due to Path MTU Discovery failurehigh

Small HTTP requests succeed but large responses or file transfers hang or fail

NetworkingAdvanced3 causes
Open runbook
Offload corruption -- TSO/GSO/ring buffer corrupting frames, causing retransmissionshigh

High TCP retransmissions but mtr shows no packet loss on the path

NetworkingProductionUSE3 causes
Open runbook
TCP connect timeout -- firewall silently dropping SYN packetscritical

curl: Connection timed out after 30-120s instead of refused

NetworkingIntermediate3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.