I have these SYN packets going from the IP 192.168.10.64, a quarantine server running on VMWare, and to 172.16.128.52 on port 445, a machine connected with VPN on a different location.
Every packet goes from this IP to the other.
The capture has been made from the firewall.
So this is how it occurs:
Not even one second later, a new SYN packet from the quarantine's MAC address goes to the firewall's MAC address, with a new source port. Still the same source & destination IP.
Do you have an idea of what could be the reason of all these retransmissions ? Is this a normal behavior ?
Thank you very much for your time.
Edit: here is the pcap file, i used the filter "ip.addr == 192.168.10.64 && ip.addr == 172.16.128.52"
asked 12 Feb '16, 00:52
edited 12 Feb '16, 02:49
You have a routing loop there.
The 1st packet goes from the sender to the firewall box.
The 2nd packet goes from the firewall box to the Cisco router.
The 3rd packet goes from the Cisco router back to the firewall.
Then this loop repeats until the TTL fulfils its purpose and stops that because it reaches 0.
So please check why the firewall uses the Cisco as its route for packets to 172.16.128.52, and why the Cisco uses the firewall as its route for these packets, and fix the routing at that box at which it is wrong.
answered 12 Feb '16, 05:56
edited 12 Feb '16, 05:58