Revision history [back]

Hello Guys,

i have a trace file where an SAP Client says: "connection to partner '1.27.223.175:3300' broken TIME Thu Dec 02 10:33:58 2021" and "DETAIL NiIRead: P=1.27.223.175:3300; L=192.5.10.69:50972 SYSTEM CALL recv COUNTER"

I do see many out of order Packets and TCP Retransmissions but from what I have seen TCP should handle it all. I have searched for tcp.port==50972 to see the stream where the connection error occurs and I see weired TCP Window followed by a TCP Keep Alive. Over 200 seconds are "wasted" for the keep alives does this mean that the client 192.5.10.69 is processing something in the background? From what I understand TCP ZeroWindow means that 192.5.10.69 cannot handle more data right?

In the 2nd image I see a normal TCP Finish sent from both client and server. So I wonder what is wrong here? My conclusion would be that the application is sending the wrong error message because the connection is not really broken in sense of tcp.

I have attached a trace file where everything after layer 4 is truncated. Network Trace

Hello Guys,

i have a trace file where an SAP Client says: "connection to partner '1.27.223.175:3300' broken TIME Thu Dec 02 10:33:58 2021" and "DETAIL NiIRead: P=1.27.223.175:3300; L=192.5.10.69:50972 SYSTEM CALL recv COUNTER"

I do see many out of order Packets and TCP Retransmissions but from what I have seen TCP should handle it all. I have searched for tcp.port==50972 to see the stream where the connection error occurs and I see weired TCP Window followed by a TCP Keep Alive. Over 200 seconds are "wasted" for the keep alives does this mean that the client 192.5.10.69 is processing something in the background? From what I understand TCP ZeroWindow means that 192.5.10.69 cannot handle more data right?

In the 2nd image I see a normal TCP Finish sent from both client and server. So I wonder what is wrong here? My conclusion would be that the application is sending the wrong error message because the connection is not really broken in sense of tcp.

I have attached a trace file where everything after layer 4 is truncated. Network Trace

Edited: Can someone tell me whats wrong with this low window size? According to 3 way handshake the client 192.5.10.69 only have a window size of 8192 but in Frame 3 Client only has 259. What happend here? How is the window size calculated? How does wireshark calculate 259? link text

Hello Guys,

i have a trace file where an SAP Client says: "connection to partner '1.27.223.175:3300' broken TIME Thu Dec 02 10:33:58 2021" and "DETAIL NiIRead: P=1.27.223.175:3300; L=192.5.10.69:50972 SYSTEM CALL recv COUNTER"

I do see many out of order Packets and TCP Retransmissions but from what I have seen TCP should handle it all. I have searched for tcp.port==50972 to see the stream where the connection error occurs and I see weired TCP Window followed by a TCP Keep Alive. Over 200 seconds are "wasted" for the keep alives does this mean that the client 192.5.10.69 is processing something in the background? From what I understand TCP ZeroWindow means that 192.5.10.69 cannot handle more data right?

In the 2nd image I see a normal TCP Finish sent from both client and server. So I wonder what is wrong here? My conclusion would be that the application is sending the wrong error message because the connection is not really broken in sense of tcp.

I have attached a trace file where everything after layer 4 is truncated. Network Trace

Edited: Can someone tell me whats wrong with this low window size? According to 3 way handshake the client 192.5.10.69 only have a window size of 8192 but in Frame 3 Client only has 259. What happend here? How is the window size calculated? How does wireshark calculate 259? link text259?

Hello Guys,

i have a trace file where an SAP Client says: "connection to partner '1.27.223.175:3300' broken TIME Thu Dec 02 10:33:58 2021" and "DETAIL NiIRead: P=1.27.223.175:3300; L=192.5.10.69:50972 SYSTEM CALL recv COUNTER"

I do see many out of order Packets and TCP Retransmissions but from what I have seen TCP should handle it all. I have searched for tcp.port==50972 to see the stream where the connection error occurs and I see weired TCP Window followed by a TCP Keep Alive. Over 200 seconds are "wasted" for the keep alives does this mean that the client 192.5.10.69 is processing something in the background? From what I understand TCP ZeroWindow means that 192.5.10.69 cannot handle more data right?

In the 2nd image I see a normal TCP Finish sent from both client and server. So I wonder what is wrong here? My conclusion would be that the application is sending the wrong error message because the connection is not really broken in sense of tcp.

I have attached a trace file where everything after layer 4 is truncated. Network Trace

Edited: Can someone tell me whats wrong with this low window size? According to 3 way handshake the client 192.5.10.69 only have a window size of 8192 but in Frame 3 Client only has 259. What happend here? How is the window size calculated? How does wireshark calculate 259?

Edited2: Yes Ip 1.27.223.175 does support window scaling with a factor of 7

Hello Guys,

i have a trace file where an SAP Client says: "connection to partner '1.27.223.175:3300' broken TIME Thu Dec 02 10:33:58 2021" and "DETAIL NiIRead: P=1.27.223.175:3300; L=192.5.10.69:50972 SYSTEM CALL recv COUNTER"

I do see many out of order Packets and TCP Retransmissions but from what I have seen TCP should handle it all. I have searched for tcp.port==50972 to see the stream where the connection error occurs and I see weired TCP Window followed by a TCP Keep Alive. Over 200 seconds are "wasted" for the keep alives does this mean that the client 192.5.10.69 is processing something in the background? From what I understand TCP ZeroWindow means that 192.5.10.69 cannot handle more data right?

In the 2nd image I see a normal TCP Finish sent from both client and server. So I wonder what is wrong here? My conclusion would be that the application is sending the wrong error message because the connection is not really broken in sense of tcp.

I have attached a trace file where everything after layer 4 is truncated. Network Trace

Edited: Can someone tell me whats wrong with this low window size? According to 3 way handshake the client 192.5.10.69 only have a window size of 8192 but in Frame 3 Client only has 259. What happend here? How is the window size calculated? How does wireshark calculate 259?

Edited2: Yes Ip 1.27.223.175 does support window scaling with a factor of 7

Edited3: The Screenshot of the TCP events before 44877:

Hello Guys,

i have a trace file where an SAP Client says: "connection to partner '1.27.223.175:3300' broken TIME Thu Dec 02 10:33:58 2021" and "DETAIL NiIRead: P=1.27.223.175:3300; L=192.5.10.69:50972 SYSTEM CALL recv COUNTER"

I do see many out of order Packets and TCP Retransmissions but from what I have seen TCP should handle it all. I have searched for tcp.port==50972 to see the stream where the connection error occurs and I see weired TCP Window followed by a TCP Keep Alive. Over 200 seconds are "wasted" for the keep alives does this mean that the client 192.5.10.69 is processing something in the background? From what I understand TCP ZeroWindow means that 192.5.10.69 cannot handle more data right?

In the 2nd image I see a normal TCP Finish sent from both client and server. So I wonder what is wrong here? My conclusion would be that the application is sending the wrong error message because the connection is not really broken in sense of tcp.

I have attached a trace file where everything after layer 4 is truncated. Network Trace

Edited: Can someone tell me whats wrong with this low window size? According to 3 way handshake the client 192.5.10.69 only have a window size of 8192 but in Frame 3 Client only has 259. What happend here? How is the window size calculated? How does wireshark calculate 259?

Edited2: Yes Ip 1.27.223.175 does support window scaling with a factor of 7

Edited3: The Screenshot of the TCP events before 44877:

Edited4: