 | 1 | initial version |
All packets up till frame 2076 are sent to the gateway with mac-address d4:21:22:71:fb:20 (OUI: Sercomm), then starting with frame 2077, packets are sent to a different Sercomm mac address (94:4a:0c:4a:4b:10).
The funny part is that the TCP/RST in frame 2086 is sent to the original mac-address again. The ACK in frame 2087 has ack value 761 (acking frame 2073), proving the data that was sent in frame 2077-2085 never reached the server.
I would look at (at least) the ARP / VRRP / HSRP packets while you do your capture. But preferably all packets to see what is happening on your subnet during this problem.
