This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

large packet problem

0

We are having a issue with a client not being about to access a server. I don’t see a packet size large then 1518 going across the network, we think that may be the issue, we are seeing RST ACK and Retransmissions together I am not sure what that means, can anyone tell me what is retransmitting and why looking at the trace?

https://www.cloudshark.org/captures/103e92950859

asked 13 Apr '13, 17:08

Ernest%20Johnson's gravatar image

Ernest Johnson
266612
accept rate: 0%

edited 14 Apr '13, 14:42

grahamb's gravatar image

grahamb ♦
19.8k330206


One Answer:

3

The net MTU size along the route is only 1460 bytes as the client's SYN packet offers a 'reduced' MSS value of 1420 bytes. In the reverse direction the server's MSS value obviously doesn't get reduced and the client attempts to send a full packet but this doesn't arrive. Path MTU discovery seems to fail as the client finally retransmits with a tcp.len of 536 but this packet gets a reset from the server - probably coming in too late.

The solution to this is have the router/fw adjust the server's MSS value to 1420 as it flows to the client. You might want to reduce your mtu size to 1460 as a circumvention. BTW: Your largest outbound packets have an ip.len of 576 which is the default mtu size. Windows uses this when you disable PMTUD at the server.

answered 14 Apr '13, 04:27

mrEEde2's gravatar image

mrEEde2
3364614
accept rate: 20%

edited 14 Apr '13, 08:53

Thank You ver much

(14 Apr '13, 21:41) Ernest Johnson
1

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(15 Apr '13, 01:15) Kurt Knochner ♦

that was the problem, we remover the device that was changing the MSS the client end

(19 May '13, 16:04) Ernest Johnson