This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP previous segment not captured, …

0

Hi

I have a scenario where vlan traffic is going through gateway SVI and some specific traffic is routed through Route-map to Cisco ASA placed in the same VLAN, Now using VMware View client when traffic is routed through route-map Vmware View does not work after authentication saying "TCP previous segment not captured" , but when i manually add gateway as ASA, Application works perfectly, i am assuming that some packets are missing within this routing.Getting confused need expert opinion. Here are the capture http://cloudshark.org/captures/8b0542a4523f Failed attempt http://cloudshark.org/captures/b5a9187cb96b Successful attempt

Ir

asked 21 Sep '13, 08:25

imrans's gravatar image

imrans
1223
accept rate: 0%

edited 21 Sep '13, 08:25


One Answer:

0

Vmware View does not work after authentication saying "TCP previous segment not captured"

So the VMmare_View client is failing after authentication but I suppose the "TCP previous segment not captured" is what you saw in the wireshark trace file, not what VMware was 'telling' you.

These messages generated because the packets arrive out of order at your workstation.
In tcp.stream eq 0 this causes the FIN packet (ip.id==0x3ed5) to arrive before the Close-Notify (ip.id==0x3ed4) at the client which is getting a reset as the socket in your client is already gone. alt text However the tcp.stream eq 0 in the 'successful' scenario shows the packets arriving in order but still the Close_Notify gets a RST, so from the VMWare client's perspective there is no real difference.

Also, in both traces remote MAC address is the same Cisco router so I'm wondering if you really provided two different scenarios in cloudshark.

answered 22 Sep '13, 06:06

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Thanks Yes!!! Traffic is going through the same Firewall but in successful case Firewall is default gateway of the host and in failed case traffic is going to SVI( default gateway) which is re-routing to the same Firewall using route-map.

Ir

(22 Sep '13, 22:59) imrans