This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP Dup Acks, but missing Seq never received

0

Hi, I am connecting to the internet from a test laptop into a Layer 2 Epipe onto an internet facing router.

For the most part, TCP application traffic is flowing correctly and all applications are working as expected - with one exception.

When I attempt to download software updates from the internet (Microsoft, Adobe etc.), I can see the initial 3-way handshake complete and the download begins. However, part of the way through the download, a single random TCP sequence number is not received on the end host - although a wireshark on the internet facing router shows it is being sent towards the end host.

The end host sends multiple DUP ACKs requesting the missing sequence number, and the internet router shows it being retransmitted towards the end host several more times - but it never arrives and end host ultimately sends a TCP RST.

Is this as simple as the "missing" segment being dropped en route from the internet router towards the end host (via the L2 Epipe)? If so, any thoughts on why it would be so specific - why only when downloading updates, and why pick one specific segment to continually drop part way through the download? Scratching my head here......

asked 19 Nov '15, 11:46

gtop81's gravatar image

gtop81
6112
accept rate: 0%


One Answer:

0

Is this as simple as the "missing" segment being dropped en route from the internet router towards the end host (via the L2 Epipe)?

according to your description, I would say: yes.

why only when downloading updates, and why pick one specific segment to continually drop part way through the download? Scratching my head here......

Maybe something in the downloader frame(s) triggers 'something' (security device) within the epipe infrastructure. Or it's a misconfigured QoS setting on a device in the epipe infrastructure that 'kills' the session (by dropping frames) because it reached a QoS limit.

Without insight, we can only guess.

Regards
Kurt

answered 19 Nov '15, 11:56

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%