Hi all, I have a network packet capture of network environment with my copier. The copier seems like drops off from the network intermittently and unable to print the files. I have to restart the machine to get it work. the workstation is 10.0.5.160 and the copier is 10.1.5.81 the link for the packet capture, https://drive.google.com/file/d/0B-n7X77Fqu_Rc0ZaNFhpZklfeGM/edit?usp=sharing here I attached the packet capture when the problem occurred and hopefully I can get a clue what to do next. asked 25 Jun '14, 02:17  forest79 edited 25 Jun '14, 02:29 |
One Answer:
The problem is not with the client but with the printer. The printer is behaving in a bad way:
Therefore, it seems that there is a software (or hardware) problem with the printer. You could try to revise the configuration or reset it. Another thing, all packets in the packet trace are duplicated. Did you use a port mirror/span to capture the traffic? This answer is marked "community wiki". answered 15 Jul '14, 09:12  naudit edited 15 Jul '14, 09:14 Hi There, Thank you for your answer and I have feed back the issue the printer supplier. Yes we are using the switch with mirroring port and we can't get hub to do the capturing. Just wondering is that any better way to do the capturing beside using the mirroring port? Thank you. (22 Jul '14, 18:51) forest79 1
No, you just need to do the port mirroring in the right way. If you mirrored the whole VLAN, then you could have mirrored the port of the client AND the port of the printer, which creates duplicate frames. In that case, please only mirror the port where the printer is connected to the switch. (23 Jul '14, 00:56) Kurt Knochner ♦ |
Copier is advertising a zero window packets and after few second client 10.0.5.160 gives up(sent RST).Zero windows means copier asking client to stop sending any more data.printer's remaining window size continuously decreasing as it receives data faster then it can process it. At some point, the printer's receive buffer will fill, it will send a zero window, and data transfer will stop. As the printer continues printing, it will keep pulling data from the receive buffer, and when there is room for more incoming data, it will send a window update and data transfer will resume but this is not happening in your case and later on client is forcefully closing the session.
Hi kishhan, when you said ' As the printer continues printing, it will keep pulling data from the receive buffer, and when there is room for more incoming data, it will send a window update and data transfer will resume but this is not happening in your case' is that imply that the copier didn't send (or failed to send) an update packets to client to get more incoming data? therefore the client is forcefully shutting.
Yes, the client is forcefully shutting (for example packet 2429 is an RST to terminate the TCP session from the client toward the printer).
To illustrate, enter the filter 'tcp.stream eq 30 && ip.src==10.0.5.81', then right-click on "Windows size value:x" in the packet details pane and select "apply as column".
Look at how the window value is at 17490 in packet 3358, then it gradually goes to 0 and stays there. It stays there for more than a full minute, then the client gives up and sends an RST to terminate the session.