we have put in a new server and netgear 48 port switch where previously they had a hub, Internet access is working perfect and they get 60Mb to the desks, however an issue that has started that was ok before is that 1 application on 4 machines out of 7 is getting eggtiming and they are being kicked out of the app (inhouse application that runs mainly with FTP) this happens randomly but frequently and other apps do not seem affected. At points the trace log to one of the machine is showing tcp previous segment not captured. Could anyone help me interpret the packet capture, apologies as i have not used it before. asked 29 Mar '16, 09:30 Roadrunner123 |
One Answer:
My interpretation is that
answered 30 Mar '16, 03:14 sindy wow, thanks Sindy, the client machines are just average desktops with one network connection. i will have a look at the speed and duplex settings next and then the network adaptors. (30 Mar '16, 03:25) Roadrunner123 One more point in completely different direction has come to my mind, can you capture simultaneously on the server and one of the problematic clients until you can see the issue happen? I'd like to be sure whether the client sends the missing frame (and so it got lost under way) or whether it does not send it at all. There could be issues like arp spoofing, causing the client to send it to a different MAC address, although it doesn't sound much likely as some client machines exhibit no problems when accessing the same server. But the issue is weird enough to look in all directions, and it is always useful to have a capture of the same occurrence of an issue from as many points along the path between the client and the server as possible. (01 Apr '16, 06:32) sindy |
Could you provide us a trace at a public accessible place like: cloud shark or dropbox
Here is a link to the capture i took yesterday
https://www.dropbox.com/sh/d0882y2g9i1xux1/AABjl8fWEACj4-2huuMdSJ4Ha?dl=0
Are we talking about FTP or are we talking about some filetransfers done by another protocol like SMB? Because I can´t see any FTP traffic in your trace.
Thanks for commenting Christian, yes the propriatary software mainly uses FTP, i will run another trace this morning and upload it.