This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP Reassembly issues

0

Hello All,

We are receiving 2 TCP packets from the vendor which should be reassembled at the client server. However, when the message hits the application it comes in as 2 separate messages: See below:

Total bytes in flight: 2109 Message Stream 1: 1348 Message Stream 2: 761

Delivered to the application(running on WINDOWS Server 2012) as: Message 1: 2107 bytes(all of message stream1 from above followed by NULL characters) Message 2: 12336 bytes(all of message stream2 from above followed by NULL characters)

Any ideas on what could be wrong?

Thanks in advance.

Joe

asked 09 Feb '17, 15:37

hackettjo's gravatar image

hackettjo
6113
accept rate: 0%

Is the network adapter on your Windows 2012 server configured to use Large Receive Offload (LRO)?

When you say stream 1 and stream 2, does that mean that the data is on two completely separate TCP connections?

(10 Feb '17, 23:49) PaulOfford

Message 1: 2107 bytes(all of message stream1 from above followed by NULL characters)

What is the byte count returned by the read from the TCP connection? If it's less than 2107, then those null characters aren't part of what you read, they're just bytes in the buffer following the actual data that was read.

Message 2: 12336 bytes(all of message stream2 from above followed by NULL characters)

The same applies.

(11 Feb '17, 00:30) Guy Harris ♦♦

Is the network adapter on your Windows 2012 server configured to use Large Receive Offload (LRO)?

  • Yes. LRO is enabled for both IPV4 and IPV6

When you say stream 1 and stream 2, does that mean that the data is on two completely separate TCP connections?

  • I'm not a network guy but both the packets/streams are part of one single message which is being delivered as two independent messages to the application..

Packets gets reassembled when sent over VPN network but the same is not the case when sent over MPLS network.

(13 Feb '17, 07:52) hackettjo

The byte count is returned as 2107 for the first stream which is 1348 + remaining bytes as nulls(00). The byte count is returned as 12336 for the second stream which is 761 + remaining nulls. The thing is that both of the streams are delivered independently without being reassembled. This is happening only on MPLS network. Works find on VPN network though.

(13 Feb '17, 07:55) hackettjo