FreeTDS Development Group

[jklowden AT schemamania.org]

On Thu, Jul 30, 2009 at 11:29:45AM -0400, Steve Fischer wrote:
> I am a network engineer investigating a complaint of slow application
> performance.  In doing a capture (using Wireshark), I noticed a fair
> number (about 125 in a 10 minute window) of responses coming from a host
> on 1433/TCP (Response Packet) with a Malformed Packet:TDS label on the
> payload.  I know that 1433/TCP is the port Microsoft SQL Server uses,
> and until today, had never heard of TDS as a protocol.  Can anyone here
> shed some light on this?  

http://www.freetds.org/tds.html

I think the Wireshark report is likely bogus: the packet doesn't conform to 
its idea of a proper TDS packet, but that's only because the Wireshark TDS 
filter isn't maintained.  That's my first guess.  

(Improvements to that filter would be a service to the community.)  

If you want to get this off your plate -- and you should, because dimes to 
donughts it's not a network issue -- look at the timings for queries arriving 
a the server and the server's response.  Unless the network is seriously 
overloaded or misconfigured, almost all the delay is in the the server 
response time.  

The solution to "slow application performance" is almost never at the network 
layer.  Rather, it's almost always in normalized logical design, proper 
selection of indexes at the physical layer, and careful use by the 
application of the server, i.e. minimizing query results and round-trips to 
the server.  

HTH.

--jkl