This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Malformed TCP - New Fragment overlaps old data (retransmission?)

0

Please check the below error i am getting on wire shark

Malformed TCP - New Fragment overlaps old data (retransmission?)

Once this error occurs the connection get closed by the source host by sending the FIN packet.What is the importance of this error and how can it be minimized?

Please let me know of any questions.

Thanks

asked 01 Apr '14, 09:10

Viral's gravatar image

Viral
11112
accept rate: 0%

Can you upload a trace at http://www.cloudshark.org so that we can take a look?

(01 Apr '14, 09:20) Jasper ♦♦

Hi,

I am facing the same error type. Unfortunately I cannot upload a sequence because of confidentiality. Is there any description explaining why this error type appears?

Thanks a lot in advance.

BR

(05 Aug '14, 01:48) FoNs

AFAIK it means that a retransmission for a packet was seen where both original and retransmission are in the trace, and do not contain the same payload content. Basically, the new segment in the retransmission overlaps the existing bytes with something else. It's up to the stack how to handle those situations, but I can guess that resetting the connection is a common reaction.

(05 Aug '14, 02:12) Jasper ♦♦

i have got the same error with a particular page on the site when try to go to this page , " new fragment overlaps old data "

interstigly it works over my 4G network but not on wired ethernet network . ?? replies to [email protected]

(18 Mar '15, 23:22) ixexplorer

One Answer:

0

The error is emitted by the reassembly routines (in four places) when the received packets overlap in some way with the already received and reassembled data, thus they are perceived as (partial) retransmissions. See epan/reassemble.c

For any specific case the capture is required to explain the actual problem.

answered 05 Aug '14, 02:20

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%