TCP Previous Segment not Captured and TCP out of order

asked 2024-04-26 00:37:11 +0000

jhutchens gravatar image

updated 2024-04-26 00:45:02 +0000

We are running Fortra Robot scheduler between an AS400 and Windows servers over a multipath SD-WAN network. For the last several months the agent on the windows server keeps losing connection to the AS400 temporarily. We use Solarwinds Orion and Solarwinds Netpath to see connectivity and run synthetic transactions and with the expection of an occasional packet drop it looks clean.

The agent uses port 7472 to connect to the AS400 and then SSH to transfer data. When I run a packet capture I see a number of TCP Previous Segment not captured and then TCP out of order. These seem to correlate with the drops the agent reports. I have uploaded the packet capture which has multiple agents captured but in this case the communication is between the AS400 150.100.10.41 and the agent at 10.33.1.210. If I filter on tcp.stream 248 that shows the stream using port 7472. I have uploaded the packet capture here as well. https://www.cloudshark.org/captures/f...

I'm at a loss at what the issue could be and seeing if anyone is seeing anything. At this point I'm leaning toward a TCP stack issue on the AS400 since it seems to be happening on multiple agents.

edit retag flag offensive close merge delete

Comments

multipath SD-WAN network

  1. Where and how was the capture done?
  2. The Cloudshark share is locked
Chuckc gravatar imageChuckc ( 2024-04-26 01:30:02 +0000 )edit

The capture is done at our data center where the server (10.33.1.210) is located. The capture is done from our Cisco ASA which connect to the SD-WAN overlay. File should now be unlocked.

jhutchens gravatar imagejhutchens ( 2024-04-26 12:59:38 +0000 )edit