This frame is a (suspected) retransmission]
I have a mail server with firewall enabled, I see a lot of stopped actions and the source IP is my router external IP. I setup wireshark on the box, triggered a session with ip.addr == myexternalRouterIP with a lot of
Frame 445295: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface \Device\NPF_{2AEC5B1B-C9CD-45A5-B7CA-2CA1416BCAB6}, id 0
Ethernet II, Src: DrayTek_66:17:48 (00:1d:aa:66:17:48), Dst: Microsof_01:1d:3b (00:15:5d:01:1d:3b)
Internet Protocol Version 4, Src: myExternalIP, Dst: 192.168.1.34
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 52
Identification: 0xc159 (49497)
010. .... = Flags: 0x2, Don't fragment
...0 0000 0000 0000 = Fragment Offset: 0
Time to Live: 127
Protocol: TCP (6)
Header Checksum: 0xffc9 [validation disabled]
[Header checksum status: Unverified]
Source Address: myExternalIP
Destination Address: 192.168.1.34
Transmission Control Protocol, Src Port: 58122, Dst Port: 25, Seq: 0, Len: 0
Source Port: 58122
Destination Port: 25
[Stream index: 5592]
[Conversation completeness: Incomplete, SYN_SENT (1)]
[TCP Segment Len: 0]
Sequence Number: 0 (relative sequence number)
Sequence Number (raw): 2438265587
[Next Sequence Number: 1 (relative sequence number)]
Acknowledgment Number: 0
Acknowledgment number (raw): 0
1000 .... = Header Length: 32 bytes (8)
Flags: 0x002 (SYN)
Window: 64240
[Calculated window size: 64240]
Checksum: 0xca12 [unverified]
[Checksum Status: Unverified]
Urgent Pointer: 0
Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
TCP Option - Maximum segment size: 1460 bytes
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - Window scale: 8 (multiply by 256)
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - SACK permitted
Kind: SACK Permitted (4)
Length: 2
[Timestamps]
[Time since first frame in this TCP stream: 9.011925000 seconds]
[Time since previous frame in this TCP stream: 6.010005000 seconds]
[SEQ/ACK analysis]
[TCP Analysis Flags]
[Expert Info (Note/Sequence): A new tcp session is started with the same ports as an earlier session in this trace]
[A new tcp session is started with the same ports as an earlier session in this trace]
[Severity level: Note]
[Group: Sequence]
[Expert Info (Note/Sequence): This frame is a (suspected) retransmission]
[This frame is a (suspected) retransmission]
[Severity level: Note]
[Group: Sequence]
[The RTO for this segment was: 9.011925000 seconds]
[RTO based on delta from frame: 445073]
So how can I understand why router is sending every second this SYN messages? Thanks in advance
When a host sends a TCP segment with SYN flag set, it usually means that this host wants to establish a TCP connection with the destination IP. You your case, it does not look like the server is responding because the firewall doesn't even allow the TCP segment to reach the mail server. If this process repeats, it could be because the software on the source host (your router) is programmed to retry over a period of time. Now why it does this is trickier to find. You need to check settings on the router to try and understand why it wants to connect to your mail server. Maybe the router needs to send logs or an alert by email. When you disable a setting, run the capture again and see if the issue is present. One last thing, it may be possible another host is using your router ...(more)
Thanks, yes, my router was configured to send alerts whioch I disabled but still getting same records in wireshark. There is no other component that sends to the server. Yes, I have several internal (in my lan ) that uses the mail servere (some used the public name so they go across the router) but everything works fine and send/receive operations works fine.
If the source MAC address ("DrayTek_66:17:48") is the actual MAC of the router interface and seeing the IPv4 TTL being 127, this increases the likelihood of the router itself being the source. There are, of course, plenty of other explanations but I like Occam's razor. You can always try to disconnect the other hosts to confirm if it is coming from the router or not. You can also try to capture from the WAN port of the router using one of the methods suggested in the Wiki. You capture from different LAN ports too if several are used. Good luck.
Thanks, OK, I will do and come back to you, but tell me what is "Occam's razor"
Simply put Occam's razor is a problem-solving principle that recommends looking for the simplest or most obvious explanation first.
Thanks, indeed, yesterday evening, I stopped all hosts that uses the mail server, triggered wireshark and there was no usual traffic as indicated. So now the question, wireshark was capturing traffic as if it was coming from router which is not the case, is it possible to search the packets and find which host is sending thos packetes to the router which are forwarded to the mail server?
You could run Wireshark while starting one host at a time and see if the host is the one trying to connect to the mail server. You may also want to run Wireshark, tshark or tcpdump on the hosts themselves to find out which one is connecting. Did you check if the MAC address ("DrayTek_66:17:48") is the actual MAC of the router interface? If NOT then you could look for that MAC address on your hosts. It is still perplexing that you would see traffic coming from the router's external IP (WAN) but know this traffic is really coming in from the local LAN. Starting the host one by one and allowing a period of time to see if it starts talking to the mail server is probable the best bet.
I, this exactly what I did this morning, I launched wireshark on the mail server, started hosts 1 by one, I reached the 3rd (which is data base server), wireshak started displaying the messages in querstion, and discvered that I have configured ity to use the public name mypublic.free.fr for the smtp server insteatd of the internal lan address mylan.sierac.net. As soon as I repalced it messages stopped showing in wirshark which it should be like this as I dont allow using smtp from WAN. Regarding the MAC 66:17:48, not sure where does it come from, my router draytek MAC starts with 00-1D... the offedning database server mac starts with 00-15......
In spite of the fact that I found from where the issue is originating but the message in wireshsark is not really helpful or ate least it does not indicate the origin and ...(more)