Hi All, I'm looking into issues with transferring files across a WAN (VPN) and see some strange packets in the pcap. Server - 10.49.3.61 Client - 172.25.225.10 Copying files from the server to the client just via windows copy/unc. I ran the capture on a transparent ASA at the Server end which is inline to the traffic flow. Issues I have are that the transfer just stalls, seems to try again and the eventually just stops with a general windows error, cannot copy blah blah. It seems to occur if I copy anything more than a few 100MB. I see references to mturoute and iperf in my captures which I have no idea where they are coming from. Neither are running on the server / client. Is there any indication as to why the capture is failing and also to why mturoute and iperf are showing within the SMB messages? The buffer on the ASA wasn't big enough so had to run circular buffer and managed to capture the moment the copy failed. This is across a DMVPN also. Capture attached https://www.dropbox.com/s/papy5awytjxfu9l/transfer.pcap?dl=0 asked 27 Nov '15, 05:07  exit12 |
One Answer:
Looking at the trace I'd say your description of the environment is incorrect. The windows client is at 10.49.3.61 and the trace was taken close(r) to the client. The server is at 172.25.225.10 and behind a WAN VPN connection through a riverbed. The initial RTT towards the server is 166 ms The direction of the traffic is from client to server -> 445 The riverbed is offering a window_scale factor of 4 The stalled session is due to a zero window offering of the riverbed device, obviously it is not getting the data forwarded fast enough over the WAN (maybe packet loss?) The occurances of "mturoute" and "iperf" are simply filen-ames in the directory of the of the server.
answered 29 Nov '15, 09:08  mrEEde |
