This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Aborting Printing Jobs [TCP Previous segment not captured] [TCP Window Full]

0

Hello there, we have some Problems with three Copy/Printing Stations. After sending a Printjob with about 500 Pages, its possible that the sended printjob will abort after 200-400 Pages. Yes, on all three Stations the same. We tried so much, but we can't locate it. We changed from Server based Printing to Client-Driver based Printing with no changes to the error.

I have a Wireshark Capture, a long one, maybe someone of you can help me. It's to big for CloudShark so i put it to my DropBox Account.

Link: https://www.dropbox.com/s/fdfds8wbhc08751/Tepro_00007_20150311115524.pcap?dl=0

I got many errors with:

1932    254.617130000   192.168.111.222 192.168.111.21  TCP 60  [TCP ACKed unseen segment] 9100→60156 [ACK] Seq=1 Ack=102277 Win=2920 Len=0
1933    254.617301000   192.168.111.21  192.168.111.222 TCP 1514    [TCP Previous segment not captured] 60156→9100 [ACK] Seq=102277 Ack=1 Win=64240 Len=1460
1934    254.617308000   192.168.111.21  192.168.111.222 TCP 1514    [TCP Window Full] 60156→9100 [ACK] Seq=103737 Ack=1 Win=64240 Len=1460
1935    254.677133000   192.168.111.222 192.168.111.21  TCP 60  [TCP ZeroWindow] [TCP ACKed unseen segment] 9100→60156 [ACK] Seq=1 Ack=105197 Win=0 Len=0

Followed by:

2066    259.098839000   192.168.111.21  192.168.111.222 TCP 1514    60242→9100 [ACK] Seq=94977 Ack=1 Win=64240 Len=1460
2067    259.137284000   192.168.111.222 192.168.111.21  TCP 60  [TCP ACKed unseen segment] 9100→60242 [ACK] Seq=1 Ack=102277 Win=2920 Len=0
2068    259.137482000   192.168.111.21  192.168.111.222 TCP 1514    [TCP Previous segment not captured] 60242→9100 [ACK] Seq=102277 Ack=1 Win=64240 Len=1460
2069    259.137489000   192.168.111.21  192.168.111.222 TCP 1514    [TCP Window Full] 60242→9100 [ACK] Seq=103737 Ack=1 Win=64240 Len=1460
2070    259.197319000   192.168.111.222 192.168.111.21  TCP 60  [TCP ZeroWindow] [TCP ACKed unseen segment] 9100→60242 [ACK] Seq=1 Ack=105197 Win=0 Len=0
2071    259.307009000   HewlettP_29:f7:1f   Broadcast   ARP 60  Who has 192.168.111.226?  Tell 192.168.111.173
2072    259.499433000   192.168.111.21  192.168.111.222 TCP 60  [TCP ZeroWindowProbe] 60242→9100 [ACK] Seq=105197 Ack=1 Win=64240 Len=1
2073    259.499602000   192.168.111.222 192.168.111.21  TCP 60  [TCP ZeroWindowProbeAck] [TCP ZeroWindow] 9100→60242 [ACK] Seq=1 Ack=105197 Win=0 Len=0

...and just 150 Packets later the same:

2216    265.537768000   192.168.111.21  192.168.111.222 TCP 1514    60271→9100 [ACK] Seq=70157 Ack=1 Win=64240 Len=1460
2217    265.537772000   192.168.111.21  192.168.111.222 TCP 1514    [TCP Previous segment not captured] 60271→9100 [ACK] Seq=78917 Ack=1 Win=64240 Len=1460
2218    265.544039000   192.168.111.222 192.168.111.21  TCP 60  [TCP ACKed unseen segment] 9100→60271 [ACK] Seq=1 Ack=84757 Win=18980 Len=0
2219    265.544198000   192.168.111.21  192.168.111.222 TCP 1514    [TCP Previous segment not captured] 60271→9100 [ACK] Seq=84757 Ack=1 Win=64240 Len=1460
2220    265.544201000   192.168.111.21  192.168.111.222 TCP 1514    60271→9100 [ACK] Seq=86217 Ack=1 Win=64240 Len=1460

asked 17 Jun '15, 00:04

DonSeppo's gravatar image

DonSeppo
6112
accept rate: 0%


One Answer:

0

There are several streams that successfully finished the data transfer (FIN - FIN/ACK), meaning the printer accepted the full data set. The transmitted data is (almost) identical, with just a few differences at the beginning (date/time/job number).

So, if those print jobs were also aborted after 200-300 pages, I't more likely to be a problem with the printer itself (bad data format, printer internal problems, etc.) than anything on the network.

Regards
Kurt

answered 17 Jun '15, 04:41

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%