This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi All,

I'm looking into issues with transferring files across a WAN (VPN) and see some strange packets in the pcap.

Server - 10.49.3.61 Client - 172.25.225.10

Copying files from the server to the client just via windows copy/unc. I ran the capture on a transparent ASA at the Server end which is inline to the traffic flow. Issues I have are that the transfer just stalls, seems to try again and the eventually just stops with a general windows error, cannot copy blah blah. It seems to occur if I copy anything more than a few 100MB. I see references to mturoute and iperf in my captures which I have no idea where they are coming from. Neither are running on the server / client. Is there any indication as to why the capture is failing and also to why mturoute and iperf are showing within the SMB messages? The buffer on the ASA wasn't big enough so had to run circular buffer and managed to capture the moment the copy failed. This is across a DMVPN also. Capture attached https://www.dropbox.com/s/papy5awytjxfu9l/transfer.pcap?dl=0

asked 27 Nov '15, 05:07

exit12's gravatar image

exit12
11557
accept rate: 0%


Looking at the trace I'd say your description of the environment is incorrect. The windows client is at 10.49.3.61 and the trace was taken close(r) to the client. The server is at 172.25.225.10 and behind a WAN VPN connection through a riverbed. The initial RTT towards the server is 166 ms The direction of the traffic is from client to server -> 445 The riverbed is offering a window_scale factor of 4 The stalled session is due to a zero window offering of the riverbed device, obviously it is not getting the data forwarded fast enough over the WAN (maybe packet loss?)

The occurances of "mturoute" and "iperf" are simply filen-ames in the directory of the of the server.

alt text

permanent link

answered 29 Nov '15, 09:08

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×238
×91
×14
×9

question asked: 27 Nov '15, 05:07

question was seen: 2,337 times

last updated: 29 Nov '15, 09:08

p​o​w​e​r​e​d by O​S​Q​A