Wireshark · Wireshark-users: Re: [Wireshark-users] Problems transfering Clear Text files over a WAN LINK

[Alan Emery <ademery@xxxxxxxxxx>]

Ricardo,

I can't provide you a definitive answer to the source of your problem, but there are some interesting clues in the trace that may help you.

The environment from the trace:

Dell Server (10.1.31.250) <--------> Cisco 1841 <--------> Remote Device (10.1.10.105)

Assumptions based on the trace:
The trace was captured on the Dell Server's side of the network
In the trace, the dominant data file movement is from the Remote Device (10.1.10.105) to the Dell Server (10.1.31.250)
The IP TTL for the outbound messages from the Dell Server was 128
The IP TTL for the inbound messages from the Remote Device was 124, this implies there may be other routing devices in the path other than the Cisco 1841, can't be certain

Observations:
Once file movement begins about frame 350 in the trace -
The offered data rate inbound from the Remote Device was about 1900Kbps
The actual data rate received inbound from the Remote Device was about 350Kbps
Nearly 3 out of 4 large (>512 bytes) inbound frames are dropped before arriving at the device where the trace was taken
The first missing packet appears to be between frames 349 and 350
The elapsed time between the missing frame and the first retransmission (frame 350 and 383) is about 250ms, that may or may not be normal RTT for your WAN
The problem of dropped frames is more sensitive to large frame transmissions (>512 bytes)

If this is a hub and spoke network, look at the large buffer space on the hub device, to see if it is being exhausted.
If you have bonded segments, look for physical layer issues in some of the segments or mismatched MTU sizes.
Look at the possible relationship between high speed links being mapped to lower speed links, this fits with your description of the problem being unidirectional.

Hopefully these clues will give you some additional insights that you can apply to your knowledge of your network and get you closer to an answer.

Alan Emery

IBM Global Solution Center
ademery (at) us (dot) ibm.com

wireshark-users-bounces@xxxxxxxxxxxxx wrote on 11/06/2009 09:23:25 AM:

> [image removed]
>
> [Wireshark-users] Problems transfering Clear Text files over a WAN LINK
>
> Ricardo Garcia Torres
>
> to:
>
> wireshark-users
>
> 11/06/2009 09:28 AM
>
> Sent by:
>
> wireshark-users-bounces@xxxxxxxxxxxxx
>
> Please respond to Community support list for Wireshark
>
> Hey There,
> I was wondering if any of you would help me out here. I'm having a
> hard time trying to transfer text files over my WAN link. I have
> several other sites where I have no problems with this.
>
> I'm able to transfer these files in one direction (let's say site A
> to site B) but when I try to transfer these files in the opposite
> direction (from B to A), after that it just stalls and do nothing
> for a few seconds, then I got various error messages everytime I try
> to copy the files. Either the network is no longer available or the
> path is too long or something like that.
>
> I have tried everything I can possible think of and I got stuck here.
> I'm pretty sure that it has something to do with some windows server
> policy or restriction somewhere.
>
> I got a capture with wireshark and the only thing I can see is
> packets received out of order, packets lost and retransmissions to
> packets that were properly received.
>
> I'm going insane, that's why I'm sending this thread to see if
> someone here have had the same problem and suggest a fix. I'm
> attaching the pcap file but I'm not sure if you will be able to see it.
>
> Thanks in advance for your help.
> ______________________________________________________
> Ricardo García
> [attachment "Penon(1).pcap" deleted by Alan Emery/Dallas/IBM]
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe