Issue with a TCP stream

asked 2022-04-26 13:21:33 +0000

CaptainPistache
3 ●3

updated 2022-04-26 13:30:31 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

Hello everyone,

I have an issue with a client establishing a connection to an Oracle database and I'm struggling to find what the root cause is.

The Oracle handshake does not complete and it seems that some segments are dropped but I cannot figure out which ones. Here is a printscreen of the TCP stream :

TCP not OK:

The thing I don't understand is the that the server seems to ACK every segment the client sent to it. From my understanding, segments 13 and 14 say "I have received the segment 455 and also the segments from 456 to 626". So why after this the client starts the Retransmission of the TCP segment 626 ?

It is important to note that the client and the server are connected through an IPsec tunnel.

I had the occasion to test the connection through another VPN tunnel (other equipments, other line) and I didn't have those issues. Here is another printscreen of the TCP stream through the 2nd VPN tunnel (working fine) :

TCP OK:

Could someone help me pinpoint what the issue could be ?

Also, I'm very interested to know if my interpretation of the TCP stream is correct or not.

Thanks a lot !

edit retag flag offensive close merge delete

Comments

Hi Graham!

Jaap ( 2022-04-26 14:09:48 +0000 )edit

First thing that comes to mind: what's the MTU settings on this?

Can you disable TNS dissection (we don't care about that), so that we get to see the TCP info column. Or better yet, can you share the capture files through some public file sharing site and post these links instead of the screenshots.

Jaap ( 2022-04-26 14:16:18 +0000 )edit

Hello Jaap,

Thank you for your answer.

Please find the printscreen without the TNS dissection :

I hope you don't mind I'm a bit reluctant to share the whole capture but I'll happily provide any information needed.

I have tested the MTU size (ping -f -l ...) and the results are the following :

VPN tunnel where it doesn't work = 1410
VPN tunnel where it works = 1364

Could the issue be related to the MTU ?

Thanks !

CaptainPistache ( 2022-04-26 15:45:14 +0000 )edit

Could the issue be related to the MTU ?

Yes, it could. That's always a thing with tunnels.

Jaap ( 2022-04-26 16:30:24 +0000 )edit

add a comment

answered 2022-04-26 20:59:36 +0000

SYN-bit

18528 ●9 ●343 ●255 https://SYN-b.it

Looks like a device on the path through the VPN connection on which the oracle connection fails is dropping all packets that have the URG flag set.

From my understanding, segments 13 and 14 say "I have received the segment 455 and also the segments from 456 to 626". So why after this the client starts the Retransmission of the TCP segment 626 ?

TCP does not handle segments, it handles streams of bytes. The ACK meaning, I have received up till (not including) this byte offset, so please send me the bytes from this offset forward. In this case, it wants to receive the bytes at offset 455 onwards. The SACK block SLE=456, SRE=626 tell the sending side that bytes 456 till 626 are already received. So theoreticaaly only 1 byte needs to be retransmitted, but in practice a block of data is retransmitted, as can be seen in this trace.

Comments

Hello SYN-bit,

Thanks a lot for your explanation ! It makes sense now. You also helped me improve my undestanding of the TCP protocol and I'm grateful for that.

CaptainPistache ( 2022-04-27 09:25:49 +0000 )edit

You're very welcome, I hope you can find the device that drops the packets with the URG flag set and that you can configure it to not do that anymore :-)

BTW If you are able to share the file (after anonimizing it), I would be interested in using it in my trainings.

SYN-bit ( 2022-04-27 10:15:48 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Issue with a TCP stream

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Issue with a TCP stream edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Issue with a TCP stream