This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

We have an issue that sometimes the client (10.10.10.70) requests a main menu from the server (192.168.1.56), it stucks and the connection times out eventually and the main menu does not get displayed at the client. We did a capture and saw the re-transmission issue as shown in the screenshot below. The server seems to be sending the data back but the client never acknowledges it. Other than the main menu request, the client and the server seem to be communicating properly according to the capture. Any help identifying this issue is greatly appreciated. Thank you

alt text

asked 07 Mar '17, 22:16

Khojal's gravatar image

Khojal
6223
accept rate: 0%


The capture was probably taken on the server, which is why you have phantom packet sizes larger than 1514 bytes in your file (those never really exist on the network). Please check out this blog post why this can be problematic for troubleshooting:

https://blog.packet-foo.com/2014/05/the-drawbacks-of-local-packet-captures/

Other than that, my guess is that you have an MTU problem. Small packets make it through, full packets don't. It's a bit hard to tell because your capture method gives inaccurate results, but it still looks like MTU trouble to me. You might want to check the connection path for the lowest MTU; some device is probably silently blocking big packets.

permanent link

answered 08 Mar '17, 01:52

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thank you Jasper for the feedback. I too suspect the issue could be related to the MTU size. However, when I checked, all MTU sizes that I could see so far are set to 1500. I'm not sure where else could be blocking big packets. Here is how the environment is setup:

  1. Windows host machine (192.168.1.0/24) where the server exists.
  2. Virtual Ubuntu server with IPTABLES firewall enabled (under Oracle Virtualbox) enp0s8 interface (192.168.1.0/24) and enp0s3 interface (10.10.10.0) where the client network resides.
  3. Virtual Android client (under GenyMotion) that is integrated with Virtualbox) -> NIC 1 connected to "Virtual Host Only Network #6" and NIC 2 connected to enp0s3 interface (10.10.10.0/24).

Do we still need to adjust the MTU size anywhere in this setup?

(08 Mar '17, 19:00) Khojal

How many hops are between client and server? Any router can be blocking the big packets, so you need to check all subnet MTUs between sender and receiver.

(09 Mar '17, 01:35) Jasper ♦♦

If all system resides on one physical machine you can try to update the NIC drivers, as sometimes old drivers have a problem with offloading.

(09 Mar '17, 01:58) Christian_R
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×752
×104

question asked: 07 Mar '17, 22:16

question was seen: 1,680 times

last updated: 09 Mar '17, 02:37

p​o​w​e​r​e​d by O​S​Q​A