Hi everybody!

Currently I'm in troubleshooting a web communication problem and I say web because a user tries to web browser unsuccessfully an HP multifuntional administration page that it is located in a remote branch that is connected to the main office using an ISP MPLS where the user is. Here comes the rare part, trying to web brower the HP multifuntional administration page locally it works! either in the same network segment or in a different network segment through local routing.

We already verify network layer connectivity and is fine, I mean, point to point communication is settup a ping from user pc to the HP multifuntional device is successful and a telnet using port 80 from user pc to the HP multifuntional device IP address shows that is open port 80.

The matter here is when graphic data is requested from a external place of that branch does not work. We have two web services whitin that branch and neither one works from outside.

We have another branch in the same scenario but it works this is the cause I suspect from the ISP MPLS to the affected branch they may be are filtering something but...

What you say???

Next the complete comunication from when user web browser an HP multifuntional administration page in the branch where it actually works alt text

Now the problematic case alt text

This question is marked "community wiki".

asked 19 May '12, 15:40

MarkNet's gravatar image

MarkNet
6112
accept rate: 0%

Could you please upload the tracefiles to http://www.cloudshark.org and paste the two links here? It's not very convenient to do network analysis in a picture viewer instead of Wireshark ;-)

(19 May '12, 15:57) SYN-bit ♦♦

link for not working communication capture http://www.cloudshark.org/captures/97f3001c88b1

link for working communication capture http://www.cloudshark.org/captures/c3c0b1767dd7

(20 May '12, 10:04) MarkNet

All the fully-sized segments are missing?! This just looks to me like just another MTU problem and not some really rare case. I'd guess firewall blocks ICMP fragmentation needed but CF bit set messages so they don't appear in the trace.

Check your MTU at the links and compare with advertised MSS, if that doesn't solve your problem please comment again.

cheers

link

answered 20 May '12, 11:00

Landi's gravatar image

Landi
2.2k51340
accept rate: 28%

I agree, it looks like an MTU based problem...

(20 May '12, 11:24) Jasper ♦

Fine, thanks for your replay on this guys i'll validate it.

(20 May '12, 11:50) MarkNet

yeap, MTU problem :) I just validated the correct MTU to use using different packet sizes in a ping from main office to the branch office once determined I used it on the wan interface of the remote branch where the problem was.

But just two more questions, since I'm a novice using wireshark how did it look to you another MTU problem?? what did you look at in the capture file??

Thanks a lot for your help guys!! cheers

(21 May '12, 21:01) MarkNet
1

Four signs for me:

  1. the difference of the MSS announced by the client (1260) and the server (1460). However this is a weak sign.
  2. the largest packet has a size of 654 bytes, so all the large packets (up to the possible MSS) were missing.
  3. the SEQ number of the packet 13 with a delta of 2741 bytes to the previous frame (that's why wireshark marked it with "previous segment lost). 4.) the behaviour of the same server software in the working example, with packtes up to 1314 bytes length (these are missing in the non working sample)

Regards
Kurt

(21 May '12, 23:07) Kurt Knochner ♦

Alright, very thanks Kurt!!

Regards, Mark

(22 May '12, 15:03) MarkNet

For me - and probably @Landi - it was mostly @Kurt's number 2. It is a common pattern that when you compare traces that work and do not work you'll see the working one with packets has full size segments while the nonworking doesn't.

Oh, and I have to admit that after 10 years of doing network analysis there is a fair amount of "gut feeling" involved :-D ...which still needs to be verified each time, of course ;-)

(22 May '12, 17:16) Jasper ♦
showing 5 of 6 show 1 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×356
×131
×26
×15
×4

Asked: 19 May '12, 15:40

Seen: 3,167 times

Last updated: 22 May '12, 17:16

powered by OSQA