This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm trying to diagnose some connectivity issues between a remote proxy (EZProxy) which is having trouble connecting to a load balanced webserver.

Looking at a tshark dump from the load balancer, I can see the initial SYN packet to establish a port 80 connection. This is swiftly followed by an Out-Of-Order SYN packet.

Then there's a sequence of 2 SYN retransmissions after 3 seconds, then again after a further 6 seconds, then 12, 24, 48 and then 96 seconds when finally I see an ACK and an HTTP request packet.

  • What would cause that kind of behaviour?
  • load balancer is using ipvs, sending packets to realservers via the LVS-DR direct routing method
  • https://www.dropbox.com/s/7xjdryh58naxkpr/24429.pcap contains traces where ip.src==ip of proxy
  • I've also noticed that reducing the cluster size to a single webserver makes the problem go away. Perhaps I'm seeing some issue with ipvs here?

Pointers on where to look next much appreciated.

(note, I would reply to comments but all my responses have tripped the spam filter!)

asked 06 Sep '13, 08:25

Paul%20Dixon's gravatar image

Paul Dixon
11114
accept rate: 100%

edited 06 Sep '13, 09:24

Did you capture the client-side and server-side traffic on the load balancer?

Is it possible to provide (parts) of the capture file on google docs, dropbox, cloudshark, etc.?

(06 Sep '13, 08:55) Kurt Knochner ♦

Solved - the problem was the assumption that it was a specific client causing the problem.

It was actually rather simple - one of the realservers in the cluster was not configured with the IP address of the cluster, so was rejecting any connection attempts directed to it.

Ultimately, I would have found this by analysing the traffic on each realserver in turn, but as I was setting up tshark on the problem server, I noticed it was missing some IP address assignments.

Doh!

permanent link

answered 06 Sep '13, 09:50

Paul%20Dixon's gravatar image

Paul Dixon
11114
accept rate: 100%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×56
×55
×43

question asked: 06 Sep '13, 08:25

question was seen: 4,582 times

last updated: 06 Sep '13, 09:50

p​o​w​e​r​e​d by O​S​Q​A