Ask Your Question
0

Windows 10 stops answering TCP packets

asked 2022-06-08 07:27:57 +0000

Robojan gravatar image

updated 2022-06-09 09:37:14 +0000

I have been hitting my head on this problem for the past few days.

I have 2 devices, (an ESP32 with the LWIP network stack via wifi, and windows 10 pro via ethernet) that are connected to a network. The ESP32 sets up a TCP server and the windows machine connects to it. This communication goes well for a long time, but at some point the windows machine stops acknowledging the incoming packets.

The capture was done on the Windows 10 machine. 192.168.4.42 belongs to the ESP and 192.168.4.245 is the windows 10 PC.

What could be the reason for this behavior? Is there something in this trace that shows the reason why the PC stops responding?

I tried to disable the windows firewall but this did not solve the problem. If the ESP does not receive a message from the PC after a certain time it will terminate the connection. You can see this happening in the trace. Increasing this time only postponed the disconnect.

Screenshot of the problem

Wireshark Capture

edit retag flag offensive close merge delete

Comments

A network trace can tell you _what_ is happening, not _why_. In this case the application log could be more informative.

Jaap gravatar imageJaap ( 2022-06-09 13:03:21 +0000 )edit

Should windows not handle TCP acknowledgements not the application?

Robojan gravatar imageRobojan ( 2022-06-09 14:07:23 +0000 )edit

Sometimes a network capture may point to application issues. But it could alos mislead you sometimes.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2022-06-09 14:44:01 +0000 )edit

What specific "time" value have you increased? Does the Win10 machine always appear to stall at the one hour (3600 seconds)? From this particular capture the Windows machine appeared to stop responding after 3600 seconds. Over the next few seconds the ESP32 sent a few more packets along with a few TCP Keep Alives before aborting the connection with the first RST. Interestingly 432ms after the ESP32 send the first RST the WIN10 machine finally responded ACKing all of the ESP32's data and sending 424 bytes of new data to the ESP32, but obviously by then it was too late.

Jim Young gravatar imageJim Young ( 2022-06-09 17:43:35 +0000 )edit

The application on both sides shuts down the connection if it does not receive a packet for x time. This was the time that i increased. I have enabled the TCP_NODELAY option on both sides. One thing I tried was to run the client side application on linux. In this case it did not disconnect after 24 hours. So either the ESP does something wrong which confuses the windows driver. The way the application uses the TCP socket is incorrect and this causes this behavior on windows, or there is a bug in the windows driver which would be unlikely.

The issue is not always at 1 hour. sometimes it happens within minutes, sometimes it takes hours. It seems related to congestion on the network. A busier network decreases the time it takes to occur.

Robojan gravatar imageRobojan ( 2022-06-10 06:59:42 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-07-19 12:38:16 +0000

Robojan gravatar image

updated 2022-07-19 12:38:33 +0000

I figured it out. Apparently the ESP32 did not respond to ARP requests, and only periodically did an ARP broadcast. With the correct filters it was clear that windows asked the ESP directly 3 times if it had the IP address, then it did broadcast the request 3 times on the interface and then switched to the default gateway, which appeared as windows suddenly not answering incoming packets.

The solution was to turn off power safe mode in the ESP.

edit flag offensive delete link more

Comments

Thanks for the update, good to see you solved the issue.

Could you by any chance share the trace that also has the ARP traffic in it? In my Wireshark classes I always explain how filtering for specific traffic might leave out other important traffic. So I advice to filter out what you don't want to see instead. This is a perfect example I could use in my classes :-)

SYN-bit gravatar imageSYN-bit ( 2022-07-20 08:56:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-06-08 07:27:57 +0000

Seen: 494 times

Last updated: Jul 19 '22