This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When downloading sql developer tools from oracle.com(using IE or Chrome) users are experiencing an issue where the download will start and just die at about 520k. From the captures i can see the client ACKing at about the 520K mark and then nothing from the server, followed up by several keep-alives from the client to the server. Since I have no way of doing a capture at the server, i can't tell if the server is sending more data after the ACK or if the ACK ever gets to the server. If this download is attempted from a mac it works fine, also, once in awhile the download will actually work but not until you try it multiple times. Another strange behavior I see during these download attempts is the browser actually sends several SYN packets to the server to try and establish a connection, so there are several TCP streams between the same IP's, most of them just RST or FIN,ACK, FIN,ACK, ACK normally. I usually don't see this behavior during downloads from other sites that aren't having issues. Just looking to see if anyone else has had this issue with the oracle site as it seems to be isolated to that particular domain.

Thanks

asked 13 Jan '14, 15:26

msemkiw's gravatar image

msemkiw
1111
accept rate: 0%


From the captures i can see the client ACKing at about the 520K mark and then nothing from the server,

well, it could be the server, but it an also be some piece of security software and/or device that blocks the download after some time, because it believes it has found some malware.

Did you thoroughly check the logs and alerts of your security software on the client and your internet firewall?

If you captured solely on the client, you should consider to capture off-box to detect if local software on the client and/or the network firewall stops frames from the server.

  • detect client security software problem: capture on a mirror port of the switch (or with a TAP) to see if the server really does not answer at a certain point in the conversation. If yes: it could be the server or your internet firewall
  • detect internet firewall problems: capture on the WAN side of your firewall (sometimes hard, if the firewall has an integrated DSL modem), to check if the server really does not answer, or if the firewall dropped the connection

Regards
Kurt

permanent link

answered 14 Jan '14, 07:06

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×293
×55
×6

question asked: 13 Jan '14, 15:26

question was seen: 1,632 times

last updated: 14 Jan '14, 07:06

p​o​w​e​r​e​d by O​S​Q​A