This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When ran a wireshark because even though we can browse to anything on the internet from our server we are receiving;

Error Message: 31: GetURL failure HTTP Error 18: An unknown error occurred while transferring data from the server: transfer closed with 4927 bytes remaining to read

We see our GETs in the wireshark and are seeing that some look good but also we see periodically lines like the below, and are trying to figure out what issue is and why it's failing. Please help;

3072  14.125484000  174.36.239.140  10.211.34.16  TCP 1429  [TCP Retransmission] 80?49173 [ACK] Seq=67626 Ack=177 Win=15680 Len=1375[Reassembly error, protocol TCP: New fragment overlaps old data (retransmission?)]
19761 34.145928000  174.36.239.140  10.211.34.16  HTTP  1897  [TCP Out-Of-Order] HTTP/1.1 200 OK  (text/plain)

19738 34.079971000  10.211.34.16  174.36.239.140  TCP 66  49237?80 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
19743 34.100824000  174.36.239.140  10.211.34.16  TCP 66  80?49237 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1380 SACK_PERM=1 WS=64
19744 34.100852000  10.211.34.16  174.36.239.140  TCP 54  49237?80 [ACK] Seq=1 Ack=1 Win=66048 Len=0
19745 34.100956000  10.211.34.16  174.36.239.140  HTTP  473 GET /cgi-bin/bfgather/windowspatchesspanish?Time=1444229715 HTTP/1.1 
19746 34.121681000  174.36.239.140  10.211.34.16  TCP 60  80?49237 [ACK] Seq=1 Ack=420 Win=15680 Len=0
19747 34.124910000  174.36.239.140  10.211.34.16  TCP 1434  [TCP segment of a reassembled PDU]
19748 34.124980000  174.36.239.140  10.211.34.16  TCP 58  [TCP segment of a reassembled PDU]
19749 34.124987000  174.36.239.140  10.211.34.16  TCP 4190  [TCP segment of a reassembled PDU]
19750 34.124990000  174.36.239.140  10.211.34.16  TCP 58  [TCP segment of a reassembled PDU]
19751 34.124992000  174.36.239.140  10.211.34.16  TCP 2810  [TCP segment of a reassembled PDU]
19752 34.125019000  10.211.34.16  174.36.239.140  TCP 54  49237?80 [ACK] Seq=420 Ack=8281 Win=66048 Len=0
19753 34.125070000  174.36.239.140  10.211.34.16  TCP 58  [TCP segment of a reassembled PDU]
19754 34.125073000  174.36.239.140  10.211.34.16  TCP 2810  [TCP segment of a reassembled PDU]
19755 34.125076000  174.36.239.140  10.211.34.16  TCP 58  [TCP segment of a reassembled PDU]
19756 34.125079000  174.36.239.140  10.211.34.16  TCP 2810  [TCP segment of a reassembled PDU]
19757 34.125096000  10.211.34.16  174.36.239.140  TCP 54  49237?80 [ACK] Seq=420 Ack=13801 Win=66048 Len=0
19760 34.145925000  174.36.239.140  10.211.34.16  TCP 58  [TCP segment of a reassembled PDU]
19762 34.145983000  10.211.34.16  174.36.239.140  TCP 66  49237?80 [ACK] Seq=420 Ack=13806 Win=66048 Len=0 SLE=13805 SRE=13806
19763 34.146092000  10.211.34.16  174.36.239.140  TCP 54  49237?80 [FIN, ACK] Seq=420 Ack=13806 Win=66048 Len=0
19766 34.166846000  174.36.239.140  10.211.34.16  TCP 60  80?49237 [ACK] Seq=15649 Ack=421 Win=15680 Len=0
19783 34.369580000  174.36.239.140  10.211.34.16  TCP 1429  [TCP Retransmission] 80?49237 [ACK] Seq=13806 Ack=421 Win=15680 Len=1375[Reassembly error, protocol TCP: New fragment overlaps old data (retransmission?)]

asked 07 Oct '15, 12:02

WidgetWolf's gravatar image

WidgetWolf
6112
accept rate: 0%

edited 08 Oct '15, 08:20

grahamb's gravatar image

grahamb ♦
19.8k330206


Without a trace it is hard to say. But an answer for the "Reassembly error, protocol TCP: New fragment overlaps old data (re transmission?)" can be found here:
https://ask.wireshark.org/questions/46011/reassembly-error-protocol-tcp-new-fragment-overlaps-old-data-re-transmission#46227

permanent link

answered 07 Oct '15, 12:45

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 08 Oct '15, 06:52

Thanks for the response but this link does not work.

(08 Oct '15, 06:45) WidgetWolf

Please try the edited link

(08 Oct '15, 06:53) Christian_R
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×23

question asked: 07 Oct '15, 12:02

question was seen: 1,816 times

last updated: 08 Oct '15, 08:20

p​o​w​e​r​e​d by O​S​Q​A