This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can a Reassembly error be sufficient to kick a client off the system

0

We have over 50,000 users on an enterprise application and on occasion users submit a request and the spinning wheel commences and after some time they are kicked out. This is a datacentric databases application that is several tiers deep. The common thread seems to be alt text This would not be enough to kick someone off the system?

alt text

asked 01 Oct '13, 10:13

Zoberist's gravatar image

Zoberist
0778
accept rate: 0%


One Answer:

0

This would not be enough to kick someone off the system?

hard/impossible to tell, just by looking at a screenshot of a single frame ;-) Can you please post a capture file (anonymized with tracewrangler) somewhere (google docs, dropbox, cloudshark)?

Wireshark seems to see a retransmission and thinks it has seen the same data before, possibly in some fragmented frames (at least that's how I interpret the message).

If that's really the case, that could (or could not) cause problems in the TCP stack of your server and/or client. If it causes problems, you should see a RESET or FIN shortly after that error message. If however, the TCP conversation (that single tcp stream) continues to exchange data, you can (most certainly) ignore the error message, at least for the problem you are describing.

and on occasion users submit a request and the spinning wheel commences and after some time they are kicked out.

There might be other systems that kick a connection, like Firewalls (state table time out) and Load Balancers (state table time out or session persistence time out). I guess you have both in place for that kind of application. If so, you'll need parallel captures in front of the clients and in front of the server(s). With those capture files, you'll be able to figure out if any intermediate device tampers with your connections.

Regards
Kurt

answered 07 Oct '13, 16:53

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%