Help needed to debug a TCP session

Question

Hi

I need some help to debug a simple TCP flow between a client and a server that I have recorded using Wireshark please. How should I post that flow here?

Meanwhile, here is an attempt to show it:

 ->  SYN
 <-  SYN, ACK
 ->  ACK
 ->  PSH, ACK Seq=1 Ack=1
 ->  PSH, ACK Seq=13 Ack=1
 ->  PSH, ACK Seq=1473 Ack=1
 <-  ACK      Seq=1 Ack=13
 ->  TCP Retransmission PSH, ACK Seq=13, Ack=1
 ->  TCP Retransmission PSH, ACK Seq=13, Ack=1
 ->  TCP Retransmission PSH, ACK Seq=13, Ack=1
 <-  FIN, ACK Seq=1, Ack=13
 ->  ACK Seq=549, Ack=2
<snip>

I understand the '3-way handshake'. But what does the retransmission signify and why does it happen 3 times?

Best regards David

Answer 1

I think the problem is due to the MSS being too large to reach the destination. Packet No 5 never made it to the server and it is the first 'full-size MSS' packet of the connection.

 [1] ->  SYN
 [2] <-  SYN, ACK
 [3] ->  ACK
 [4] ->  PSH, ACK Seq=1 Ack=1     (tcp.len=12)
 [5] ->  PSH, ACK Seq=13 Ack=1    (tcp.len=1460)  <<< never arrives 
 [6] ->  PSH, ACK Seq=1473 Ack=1  (tcp.len=???)
 [7] <-  ACK      Seq=1 Ack=13  acking [4]
 [8] ->  [5']   TCP Retransmission PSH, ACK Seq=13, Ack=1 <<< never arrives 
 [9] ->  [5'']  TCP Retransmission PSH, ACK Seq=13, Ack=1 <<< never arrives 
[10] ->  [5'''] TCP Retransmission PSH, ACK Seq=13, Ack=1 <<< never arrives 
[11] <-  FIN, ACK Seq=1, Ack=13  acking [4]
[12] ->  ACK Seq=549, Ack=2

You might want to reduce your MTU on the route to 1400 and see if it helps...