This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP Reassembly error while capturing Cisco VPN client traffic

0

I am getting the same error. We have a few users who connect to the corporate network using Cisco VPN Client software. They open up two Explorer windows, each with a UNC path to two different shares on the same file server. When they try to copy a file from one share to another while VPN'd in from home, it just sits there saying "Calculating..." and eventually times out. A wireshark capture on the Cisco Systems VPN adapter shows multiple "Reassembly errors" saying "Reassembly error, protocol TCP: New fragment overlaps old data (retransmission?)]. Further into the packet says it's malformed. Same as the image in another question(in red). How would I even begin to diagnose this?

This packet's info has a TCP Retransmission errr, has a "Source" IP address of the VPN adapter (10.10.10.100) and the destination is the file server's internal IP address (192.168.200.100).

There are other packet errors where the source and destination IP address are reversed and those packet errors report TCP Dup ACK.

Any ideas anyone?

UPDATE: I would also like to mention, this issue is Cisco Client VPN specific. I installed the Shrew VPN Client software, imported the PCF file and it works perfectly.

EDIT: I converted your comment to a new question, as your problem is (most certainly) not related to the one in the original question.

asked 14 Oct '13, 12:34

g0ldeneye's gravatar image

g0ldeneye
1111
accept rate: 0%

edited 14 Oct '13, 13:44

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237

where did you capture? On the system with the VPN client software?

(14 Oct '13, 13:39) Kurt Knochner ♦