This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.
0
1

Been troubleshooting this bizarre issue - we have a dedicated server running 2 VMs and only 1 ip address to share between them on the NIC. We setup RRAS on the host (2012R2) and had the 2 VMs behind a NAT. The strange thing is that we saw corruption of Exchange email attachments and HTTPS downloads would fail within the first megabyte on both the VMs. However if you tried to download a file via HTTPS on the host it would work fine. Additionally the failure seems to correlate with the speed of the server - a slow HTTPS download on the VM (less than 50KB/sec) would not fail but a fast download would (anything above 75KB/sec).

We have since reconfigured this setup and made one of the VMs internet facing, disabled RRAS on the host (we have console access via hardware), and then setup RRAS on the internet facing VM and got the second VM to NAT through that.

We now see that the internet-facing VM can download files via HTTPS without issue, but the second VM still cannot.

I ran WireShark and see the following (indicative):

screenshot

Any input? Thanks! :)

asked 24 Jun '15, 10:09

Mindsphere's gravatar image

Mindsphere
6123
accept rate: 0%

edited 24 Jun '15, 14:30

Lekensteyn's gravatar image

Lekensteyn
2.2k3724

Can you share a capture in a publicly accessible spot, e.g. CloudShark, Google Drive, Dropbox?

Otherwise I only can tell you without guessing, that there are FRAMES which have a purple and others which have a black background.

(24 Jun '15, 11:20) Christian_R

Ok it is really not much what I can see in this screenshots. But I will try:

Picture1(03.02:18 AM): I can see Out of Order packets only with source IP .243.189 and some Dup-ACK (which are probably D-SACKs) Timing seems to be O.K.

Picture2 (3.02:27): I can still see Out of Order packets a probably packet loss no ACKs and in the end the IP .10.2 gives up with an RST. And there is a gap between packet 1876 and 2025.

So the question is what mixes the packets and where occurred the packet loss, how many hops are between these hosts. Maybe there different ways in the network? So better would still be the whole trace.

(25 Jun '15, 12:46) Christian_R
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×75
×69

question asked: 24 Jun '15, 10:09

question was seen: 1,087 times

last updated: 25 Jun '15, 12:46

p​o​w​e​r​e​d by O​S​Q​A