topoden's profile - activity

@Christian_R: Ah, OK. Thank you!

@Christian_R: "....Paket 325-330, are to big for the tunnel, and didn´t make it through the tunnel. At the end the clien

@Packet_vlad: "...Packet 324 in client trace must have been split into 2 packets by NIC before being sent on the wire to

@Packet_vlad: ".....While capturing, did you have capture filter applied? Packets 324 and 325 (client trace) have the sa

Good day,

I am trying to debug problematic case with FIX message is being lost on regular basis. What I mean by this, is there are two applications (FIX client and FIX server). Those applications establish connection and start exchanging Hearbeat messages. When finally client application decides to send order message (this message is of longer size and can not fit in one packet, it takes 2-3 packets normally), connection drops with "An existing connection was forcibly closed by the remote host." message produced by both application's network api (Windows).

I have recoded pcap file

I wonder would could be possible reason, or if unclear, what should I review / check next.

Thank you for your help.

Update 1: Adding previous day pcap file as requested by Christian_R in comments.

Update 2: Adding both server pcap and client pcap files. It looks that checking client side pcap has something very interesting in it at around Frame #325. What does that "TCP Out-Of-Order" sent by client itself mean?

Thank alot @Christian_R and @Packet_vlad. Your ideas and explanations helped alot.

Thank alot @Christian_R and @ Packet_vlad. Your ideas and explanations helped alot.

@Packet_vlad: "...maybe you know, is it "site-to-site" or "remote access" VPN type?...." Our IT guys ensured its "site-

"...maybe you know, is it "site-to-site" or "remote access" VPN type?...." Our IT guys ensured its "site-to-site"

"...I got the same finding. Working trace: Reason for problem is for most likely the answer I gave above. Not working ex

"....is your "working" example shows the same client traffic? I can't fully understand how the network is built. It seem

"....is your "working" example shows the same client traffic? I can't fully understand how the network is built. It seem

"... While capturing, did you have capture filter applied? Packets 324 and 325 (client trace) have the same Seq.N. (not

RST + ACK + CWR message, beginner needs help (FIX application) Good day, I am trying to debug problematic case with FI

"...That means, that the port was was not ready to establish a session. Most likely because the service was down...." A

"...As for network itself ipsec always tells me "check for MSS/MTU values and ICMP blackholes on the path..." Thank you,

"...Another hint is that before session finally is initiated the SYN gots often an RST as an answer." Could you please

"...But I would guess there is something inside the oder packet which causes the application to crash...." Unfortunatel

"...But I would guess there is something inside the oder packet which causes the application to crash...." Unfortunatel

"...A better trace would help...." It always happens this way... The issue happens every day untill you start hunting

"....What's your link/environment? Are there many middleboxes?...." The machines are physically located vary far away

"....But in your first trace client didn't send anything, it's just getting RST out of nowhere. Moreover this RST has j

OK, I've updated the question with the link to the previous day pcap file. It has the messages since the connection was

RST + ACK + CWR message, beginner needs help (FIX application) Good day, I am trying to debug problematic case with FI

Unfortunately, I started recording this session too late and do not have all the messages since TCP connection is establ

RST + ACK + CWR message, beginner needs help (FIX application) Good day, I am trying to debug problematic case with FI