Ask Your Question

Issue with a TCP stream

asked 2022-04-26 13:21:33 +0000

updated 2022-04-26 13:30:31 +0000

grahamb gravatar image

Hello everyone,

I have an issue with a client establishing a connection to an Oracle database and I'm struggling to find what the root cause is.

The Oracle handshake does not complete and it seems that some segments are dropped but I cannot figure out which ones. Here is a printscreen of the TCP stream :

TCP not OK:

The thing I don't understand is the that the server seems to ACK every segment the client sent to it. From my understanding, segments 13 and 14 say "I have received the segment 455 and also the segments from 456 to 626". So why after this the client starts the Retransmission of the TCP segment 626 ?

It is important to note that the client and the server are connected through an IPsec tunnel.

I had the occasion to test the connection through another VPN tunnel (other equipments, other line) and I didn't have those issues. Here is another printscreen of the TCP stream through the 2nd VPN tunnel (working fine) :


Could someone help me pinpoint what the issue could be ?

Also, I'm very interested to know if my interpretation of the TCP stream is correct or not.

Thanks a lot !

edit retag flag offensive close merge delete


Hi Graham!

Jaap gravatar imageJaap ( 2022-04-26 14:09:48 +0000 )edit

First thing that comes to mind: what's the MTU settings on this?

Can you disable TNS dissection (we don't care about that), so that we get to see the TCP info column. Or better yet, can you share the capture files through some public file sharing site and post these links instead of the screenshots.

Jaap gravatar imageJaap ( 2022-04-26 14:16:18 +0000 )edit

Hello Jaap,

Thank you for your answer.

Please find the printscreen without the TNS dissection :

I hope you don't mind I'm a bit reluctant to share the whole capture but I'll happily provide any information needed.

I have tested the MTU size (ping -f -l ...) and the results are the following :

  • VPN tunnel where it doesn't work = 1410
  • VPN tunnel where it works = 1364

Could the issue be related to the MTU ?

Thanks !

CaptainPistache gravatar imageCaptainPistache ( 2022-04-26 15:45:14 +0000 )edit

Could the issue be related to the MTU ?

Yes, it could. That's always a thing with tunnels.

Jaap gravatar imageJaap ( 2022-04-26 16:30:24 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2022-04-26 20:59:36 +0000

SYN-bit gravatar image

Looks like a device on the path through the VPN connection on which the oracle connection fails is dropping all packets that have the URG flag set.

From my understanding, segments 13 and 14 say "I have received the segment 455 and also the segments from 456 to 626". So why after this the client starts the Retransmission of the TCP segment 626 ?

TCP does not handle segments, it handles streams of bytes. The ACK meaning, I have received up till (not including) this byte offset, so please send me the bytes from this offset forward. In this case, it wants to receive the bytes at offset 455 onwards. The SACK block SLE=456, SRE=626 tell the sending side that bytes 456 till 626 are already received. So theoreticaaly only 1 byte needs to be retransmitted, but in practice a block of data is retransmitted, as can be seen in this trace.

edit flag offensive delete link more


Hello SYN-bit,

Thanks a lot for your explanation ! It makes sense now. You also helped me improve my undestanding of the TCP protocol and I'm grateful for that.

CaptainPistache gravatar imageCaptainPistache ( 2022-04-27 09:25:49 +0000 )edit

You're very welcome, I hope you can find the device that drops the packets with the URG flag set and that you can configure it to not do that anymore :-)

BTW If you are able to share the file (after anonimizing it), I would be interested in using it in my trainings.

SYN-bit gravatar imageSYN-bit ( 2022-04-27 10:15:48 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-04-26 13:21:33 +0000

Seen: 145 times

Last updated: Apr 26 '22