Post a solution

Like a tab "Ask a question" we have here there should be one more available with "Post a solution" like i am doing today with my troubleshooting experience with wirehsark,which otherwise would have been very difficult to solve.The issue i'm mentioning was going on from more than a month and it took less than some 2 hourse to solve with wireshark, Few days back i got an issue where we have 2 servers behind netscaler loadbalancer and they were working fine but the moment the user was adding 3rd server all request to that server was getting rejected(as per application log on that 3rd server).Then we started capturing traffic on both server and Loadbalancer simultaneously,and found that when a client is intiating a request to loadbalancer virtual ip, it was getting forwarded to that3rd app server with destination mac say "b"(app server mac) but what odd we found on loadbalancer capture was while replying servers mac was different than what the request was sent on(ideally it should be "b" but it was showing "c").While checking server network config we found that it was configured with dual stack (both ipv4 & ipv6 add) and that mac address was associated with ipv6 address.(actually ipv6 was enabled due to autoconfiguration).After some googling i found that "When the destination host can understand either protocol, IPv6 should be the preferred protocol. If the attempt at IPv6 fails, then IPv4 will be used instead. Dual stack hosts query DNS servers for both A records and AAAA records (AAAA should be preferred).