Hi
I am not sure if this is the right place to ask but i could use another opinion on a capture i am reviewing.
I am fighting with CenturyLink regarding some retransmit issues with RDP and a customer on their network
When i capture on my side when the customer is RDP'd into our services is an icmp destination unreachable (fragmentation needed) and then a bunch of retransmits.
the strange thing is the original packet length in the icmp message is higher than 1500 which is the mtu that is specified but none of the original packets are actually that length. What is even more puzzling to me is that it is actually reporting back the length of 2 frames that i am thinking were somehow combined at some point along the path.
I have attached a sample pcap frames of interest that i am talking about are 26, 27, 28 26 has total length of 1500 27 has a total length of 273 totaling 1773 icmp states original frame is 1733 1773 - 40 for the striped headers of 26, and 27 = 1733 so that makes me think somewhere centurylink concatenated frame 26 and 27 for some reason?
