This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

strange web download behavior

0

When downloading sql developer tools from oracle.com(using IE or Chrome) users are experiencing an issue where the download will start and just die at about 520k. From the captures i can see the client ACKing at about the 520K mark and then nothing from the server, followed up by several keep-alives from the client to the server. Since I have no way of doing a capture at the server, i can't tell if the server is sending more data after the ACK or if the ACK ever gets to the server. If this download is attempted from a mac it works fine, also, once in awhile the download will actually work but not until you try it multiple times. Another strange behavior I see during these download attempts is the browser actually sends several SYN packets to the server to try and establish a connection, so there are several TCP streams between the same IP's, most of them just RST or FIN,ACK, FIN,ACK, ACK normally. I usually don't see this behavior during downloads from other sites that aren't having issues. Just looking to see if anyone else has had this issue with the oracle site as it seems to be isolated to that particular domain.

Thanks

asked 13 Jan '14, 15:26

msemkiw's gravatar image

msemkiw
1111
accept rate: 0%


One Answer:

0

From the captures i can see the client ACKing at about the 520K mark and then nothing from the server,

well, it could be the server, but it an also be some piece of security software and/or device that blocks the download after some time, because it believes it has found some malware.

Did you thoroughly check the logs and alerts of your security software on the client and your internet firewall?

If you captured solely on the client, you should consider to capture off-box to detect if local software on the client and/or the network firewall stops frames from the server.

  • detect client security software problem: capture on a mirror port of the switch (or with a TAP) to see if the server really does not answer at a certain point in the conversation. If yes: it could be the server or your internet firewall
  • detect internet firewall problems: capture on the WAN side of your firewall (sometimes hard, if the firewall has an integrated DSL modem), to check if the server really does not answer, or if the firewall dropped the connection

Regards
Kurt

answered 14 Jan '14, 07:06

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%