This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm using Wireshark and tcpdump to capture traffic in order to debug a timeout issue that I'm facing when I'm connected to out website from our local network (I don't have any problem when using other networks).

I analysed capture files using WireShark and noticed that (only for the requests that timeout):

  • The server get only a SYN packet (more than once)

alt text

  • The client get the SYN+ACK from the server !
  • List item

alt text

UPDATE:

Apparently it's a NAT issue. (cf https://forum.fortinet.com/tm.aspx?m=120355#120439 )

I can't check nor change NAT configuration. Is there any workaround to this issue?

Thanks

PS: There is a FortiGuard proxy set up on our local netwok.

asked 07 Jul '15, 01:52

mr1azl's gravatar image

mr1azl
6113
accept rate: 0%

edited 08 Jul '15, 07:56

The client has a session with the proxy. And the proxy tries to initiate a session with the server. It seems that something blocks the Syn or the Syn/Ack. Are you able to see the connection request with the " netstat" command? For example netstat -ano on Windows OS. Btw the time is not really in sync.

(07 Jul '15, 03:23) Christian_R

I can't run netstat on the server (we have more than 20k request/s). I still have the same problem even if I set the time on the server

(07 Jul '15, 04:37) mr1azl

which OS are you using?

(07 Jul '15, 04:42) Christian_R

centos 6.6

(07 Jul '15, 04:44) mr1azl

If you can't do a netstat with a grep them it could be hard to find the failure. you must investigate what haĆ¼pens with the syn, if you want to find the root cause. Was the trace taken on the server?

(07 Jul '15, 04:49) Christian_R

Yes the capture was taken in the server. Cloud you explain to me how could netstat help us to figure out what happens to syn?

(07 Jul '15, 05:38) mr1azl

Netstat can show you the tcp-state of a tcp connection. So in your case the expectation could be: nothing, syn received or time wait. So if we see nothing then something blocks the syn.

(07 Jul '15, 05:41) Christian_R

Interesting Update. But why does your Server not reply the Syn with a Syn/Ack (if the trace was taken on the Server)???

(08 Jul '15, 08:04) Christian_R
showing 5 of 8 show 3 more comments
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×104
×55
×22

question asked: 07 Jul '15, 01:52

question was seen: 4,689 times

last updated: 08 Jul '15, 08:20

p​o​w​e​r​e​d by O​S​Q​A