This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi guys, im pretty much new to wireshark so i dont got a clue what this would mean. I have weird dissconnections in the past 6 months and its getting seriously annoying. The dissconnect takes a second and the internet is back on. Its annoying when you are playing or doing other stuff and i must solve it. Um, dissconnections accured on - Skype, TeamSpeak3, Guild Wars 2, Uplay Games (AC Unity), Steam Games (Dota 2 + GTA V + Dying Light), Origin Games (Battlefield + Dragon Age). I've managed to capture the dissconnection and I will detail as much as i can in order to get your help which will be highly appriciated. As for now i hope this info will help: 40282 1581.257224000 X.X.X.X 69.147.228.234 TCP 66 57558→41144 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

asked 30 Apr '15, 15:12

orele1989's gravatar image

orele1989
6114
accept rate: 0%

edited 30 Apr '15, 15:17

Are you using a wired or wireless connection? Please describe your network e.g. PC > Router > Modem and upload an unfiltered packet capture. When the issue occurs try pinging your default gateway and the dns servers.

(01 May '15, 00:34) Roland

Can you share a capture in a publicly accessible spot, e.g. CloudShark?

(01 May '15, 01:53) Jaap ♦

Hi guys,

As for the System details and usage:

  • I'm using a wired connection.
  • PC is MSI GT60 2PC Dominator (Gaming Laptop)
  • Router is D-Link, Model 6740U vH.1
  • The issue occurs as i mentioned for 1-2 Seconds, afterwards everything is Ok.
  • As for the wireshark capture that I've been asked to give - can i know what do you need exacly? (This is the first time im taking advices for the program and since my IP Details are mentioned i'd rather not share or publish in the internet for my personal security reasons)
  • Many thanks!
(03 May '15, 12:50) orele1989
1

As for the wireshark capture that I've been asked to give - can i know what do you need exacly?

The pcap file you captured. Please upload it somewhere (google drive, dropbox, cloudshark.org) and post the link here.

(03 May '15, 14:18) Kurt Knochner ♦

And basicly there is no problem containing my IP in it? (Thats why i didnt upload it yet..)

(03 May '15, 14:54) orele1989
1

Your external IP will not be in the packet capture if you started it on the PC.

(03 May '15, 15:08) Roland

I did used it on the PC, and from what i see its a private network with A Class IP Address, is that ok?

(03 May '15, 15:49) orele1989

Guys i hope that is Ok, I've uploaded the capture to the G-Drive.

This is the link - https://drive.google.com/open?id=0B1czkdfYICQpb0xqWFNUeTZmVWc&authuser=0 (Download it and use Wireshark)

Since the capture was opened for a while, theres tons of non relevent information in my opinion. As far as i know the issue is located in frames 40484 & 40282.

Many thanks for everyone who helps me out!

(04 May '15, 16:32) orele1989

Anyone?

Is the link even working?

(05 May '15, 12:56) orele1989
showing 5 of 9 show 4 more comments

"As for now i hope this info will help: 40282 1581.257224000 X.X.X.X 69.147.228.234 TCP 66 57558→41144 [SYN] Seq=0"

I only see two SYN Requests to the Address 69.147.228.234 nothing else. Maybe there is something beneath you and the Server (e.g. Firewall).

alt text

And also I can see a lot of other disconection, but without further information it is not easy to tell why.

permanent link

answered 05 May '15, 13:18

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 05 May '15, 13:20

I'll be glad to understand what kind of other dissconnections you see.

In addition what further information is required? (I'll get it asap)

(05 May '15, 13:31) orele1989

I see that you use a lot of http, https and udp traffic. At the begining everything went fine from my point of view.

But then I can see that in some ssl session for about 20 seconds no trafic goes on and after that the session ends. This I can see for several Sessions. And in the meanwhile of this other trafic there is a lot of udp traffic.

So here are a few Questions: - Is your System under heavy CPU or I/O Load? - Which of your described protocols were active during this trace?

(05 May '15, 14:30) Christian_R

I see.

I believe that there may be a load going on since as i said im playing games, by the way sometimes skype is also involved while we play. Most of the other usage would be normally internet usage in http as you saw. I'd prefer to mention the serrvices that i use in the day routine and not to protocols in order to avoid mistakes even tho i think you mentioned most of the protocols usage. Um Since im learning information security i installed the Vmware 6 month ago (i think the problem exists for the same time) do you think it had effect that is connected to the issue?

(06 May '15, 00:11) orele1989

You can still see UDP packets arriving in the same second as packet 40484. Your router has some firewall features. Can you please disable them or check the logs. The packets sent to 69.147.228.234 are marked DSCP 32.

Does the problem only occur with DSCP marked packets?

Do you have other devices connected to the router?

Do they have the same problem?

permanent link

answered 06 May '15, 02:37

Roland's gravatar image

Roland
7642415
accept rate: 13%

Other Pc's / mobile phones are connected to the network i didnt really verify if other devices also dissconnect even tho i think not.

In addition I've tryed to work without the firewall on and the issue still occurs and there is no change. Do you want me to take another another capture While its off?

As for the DSCP packets - i dont even know what that really means extra information could be nice ill try to look at the given packets to understand.

(06 May '15, 03:01) orele1989

What Badnwith do you have at your internet connection?

(06 May '15, 16:24) Christian_R

The packets never arrive at the server or something on the way are blocking them, but the internet is not down because we still see incoming traffic. DSCP is used to differentiate traffic. 32 is usually streaming video. You need to run a packet capture on the router or in front of the host. Check if the other devices are working fine when the issue occurs. Try pinging the server.

(09 May '15, 10:49) Roland
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×63

question asked: 30 Apr '15, 15:12

question was seen: 1,419 times

last updated: 09 May '15, 10:50

p​o​w​e​r​e​d by O​S​Q​A