HTTP / FTP download timeout

[sames4239]

I was wondering if anyone had any ideas on what is wrong here:

I have noticed that when I start a download (HTTP or FTP) on any PC connected to the network, the download will timeout after about 2-3 minutes at about 3-5 meg downloaded. The download will either stop or will stop with the following error: The connection with the server was reset. I believe this is a problem with the router because it will not happen when the PC is directly connected to the DSL line.

The config:
I have a Cisco 1605 dual Ethernet router connected to a 768k DSL line and a Catalyst 2940 switch.

Troubleshooting steps:
I have this problem on all PC's and servers regardless of OS.

The problem goes away when the router is removed.

The problem only happens after about 2-3 minutes have passed and about 3-5 Meg downloaded.

The problem seems to be load sensitive. I have had a download go longer when there is no other load on the network. Introduction of any load will cause the original download to fail.

No errors show up when I do a sh int while doing a test.

It affects HTTP and FTP traffic only. SMTP and other don't appear to be affected.

The best way I can characterize the problem is that my router can't seem to adjust the connection to handle fluctuations in bandwidth or is preventing "control data" from making it back to the remote server to maintain the connection.

Any ideas would be appreciated.

Thanks,

Steve

 

[pmesjar]

Send the config of the router...

Peter Mesjar
CCNP, A+ certified
pmesjar@centrum.sk

"The only true wisdom is in knowing you know nothing.

 

[baddos]

Post "show interfaces" and "show running-config" from your router.

 

[sames4239]

sh int:

Ethernet0 is up, line protocol is up
Hardware is QUICC Ethernet, address is 0010.7bf9.14d4 (bia 0010.7bf9.14d4)
Description: INSIDE NETWORK
Internet address is 10.0.0.1/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters 2w0d
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/64/0 (size/max total/threshold/drops)
Conversations 0/23/256 (active/max active/max total)
Reserved Conversations 1/1 (allocated/max allocated)
Available Bandwidth 7340 kilobits/sec
5 minute input rate 21000 bits/sec, 3 packets/sec
5 minute output rate 7000 bits/sec, 2 packets/sec
6441728 packets input, 1918792691 bytes, 0 no buffer
Received 91474 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
8063250 packets output, 1947004749 bytes, 0 underruns
0 output errors, 28162 collisions, 0 interface resets
0 babbles, 0 late collision, 32389 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
Ethernet1 is up, line protocol is up
Hardware is QUICC Ethernet, address is 0010.7bf9.14d5 (bia 0010.7bf9.14d5)
Description: INTERNET
Internet address is xxx.xxx.xxx.xxx/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:08, output 00:00:00, output hang never
Last clearing of "show interface" counters 2w0d
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/64/0 (size/max total/threshold/drops)
Conversations 0/2/256 (active/max active/max total)
Reserved Conversations 1/1 (allocated/max allocated)
Available Bandwidth 7340 kilobits/sec
5 minute input rate 6000 bits/sec, 1 packets/sec
5 minute output rate 21000 bits/sec, 1 packets/sec
7828371 packets input, 1930000357 bytes, 1 no buffer
Received 23024 broadcasts, 0 runts, 0 giants, 1 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
6415434 packets output, 1913098805 bytes, 0 underruns
0 output errors, 4195 collisions, 0 interface resets
0 babbles, 0 late collision, 35960 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
Virtual-Template1 is down, line protocol is down
Hardware is Virtual Template interface
Interface is unnumbered. Using address of Ethernet1 (xxx.xxx.xxx.xxx)
MTU 1500 bytes, BW 100000 Kbit, DLY 100000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, loopback not set
Keepalive set (10 sec)
DTR is pulsed for 5 seconds on reset
LCP Closed, multilink Closed
Closed: IPCP
Last input never, output never, output hang never
Last clearing of "show interface" counters 2w0d
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue :0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
0 carrier transitions
Virtual-Template2 is down, line protocol is down
Hardware is Virtual Template interface
Interface is unnumbered. Using address of Ethernet1 (xxx.xxx.xxx.xxx)
MTU 1500 bytes, BW 100000 Kbit, DLY 100000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, loopback not set
Keepalive set (10 sec)
DTR is pulsed for 5 seconds on reset
LCP Closed, multilink Closed
Closed: IPCP
Last input never, output never, output hang never
Last clearing of "show interface" counters 2w0d
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue :0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
0 carrier transitions

 

[sames4239]

and sh config:

Using 6251 out of 7506 bytes
!
version 12.2
service timestamps debug datetime show-timezone
service timestamps log datetime show-timezone
service password-encryption
!
hostname mwsr1
!
logging buffered 4096 errors
logging console errors
aaa new-model
aaa authentication login default local group radius line none
aaa authentication login xauth_list group radius local
aaa authentication ppp default if-needed local group radius
aaa authorization exec default group radius none
aaa authorization network default group radius none
aaa accounting exec default start-stop group radius
aaa accounting connection default start-stop group radius
enable secret 5
enable password 7
!
username admin password 7
clock timezone EDT -5
clock summer-time EDT recurring
ip subnet-zero
ip domain-list domainname.com
no ip domain-lookup
ip domain-name domainname.com
ip name-server 10.0.0.15
ip name-server 209.84.253.12
ip name-server 209.84.253.11
ip dhcp excluded-address 192.168.254.1 192.168.254.63
!
ip dhcp pool MWS
network 192.168.254.0 255.255.255.0
dns-server 209.84.253.11 209.84.253.12
default-router 192.168.254.1
domain-name domainname.com
lease 3
!
!
class-map match-all VOIP
match access-group 102
!
!
policy-map VONAGE
class VOIP
bandwidth 160
shape average 128000
!
vpdn enable
vpdn logging
!
vpdn-group L2TP
! Default L2TP VPDN group
accept-dialin
protocol l2tp
virtual-template 2
no l2tp tunnel authentication
!
vpdn-group PPTP
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
!
!
!
interface Ethernet0
description INSIDE NETWORK
ip address 192.168.254.1 255.255.255.0 secondary
ip address 192.168.1.2 255.255.255.0 secondary
ip address 10.0.0.1 255.255.255.0
ip nat inside
service-policy output VONAGE
!
interface Ethernet1
description INTERNET
ip address xxx.xxx.xxx.xxx 255.255.255.0
ip access-group INBOUND in
ip access-group OUTBOUND out
ip nat outside
service-policy output VONAGE
!
interface Virtual-Template1
ip unnumbered Ethernet1
peer default ip address pool VPDN
ppp callback accept
ppp authentication ms-chap chap pap callin
ppp multilink
!
interface Virtual-Template2
ip unnumbered Ethernet1
peer default ip address pool VPDN
ppp authentication ms-chap chap pap callin
ppp multilink
!
ip local pool VPDN 10.0.0.64 10.0.0.71
ip nat translation timeout 7200
ip nat translation tcp-timeout never
ip nat translation udp-timeout 86400
ip nat inside source list VALIDNAT interface Ethernet1 overload
ip nat inside source static 10.0.0.11 xxx.xxx.xxx.xxx
ip nat inside source static 10.0.0.12 xxx.xxx.xxx.xxx
ip nat inside source static 10.0.0.15 xxx.xxx.xxx.xxx
ip nat inside source static 10.0.0.16 xxx.xxx.xxx.xxx
ip nat inside source static 10.0.0.18 xxx.xxx.xxx.xxx
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.1 100
no ip http server
ip pim bidir-enable
!
ip radius source-interface Ethernet0
!
ip access-list extended INBOUND
permit tcp any any established
permit udp any host xxx.xxx.xxx.xxx eq tftp
permit udp any host xxx.xxx.xxx.xxx range 5060 5063
permit udp any host xxx.xxx.xxx.xxx range 10000 20000
permit udp any eq 6801 host xxx.xxx.xxx.xxx
permit tcp any host xxx.xxx.xxx.xxx eq www
permit tcp any host xxx.xxx.xxx.xxx eq 443
permit tcp any host xxx.xxx.xxx.xxx eq 1494
permit tcp any host xxx.xxx.xxx.xxx eq 1604
permit tcp any host xxx.xxx.xxx.xxx eq smtp
permit tcp any host xxx.xxx.xxx.xxx eq 143
permit tcp any host xxx.xxx.xxx.xxx eq pop3
permit tcp any host xxx.xxx.xxx.xxx eq www
permit tcp any host xxx.xxx.xxx.xxx eq 443
permit tcp any host xxx.xxx.xxx.xxx eq 22
permit udp any host xxx.xxx.xxx.xxx eq domain
permit tcp any host xxx.xxx.xxx.xxx eq www
permit tcp any host xxx.xxx.xxx.xxx eq 443
permit tcp any host xxx.xxx.xxx.xxx eq 22
permit tcp any host xxx.xxx.xxx.xxx eq www
permit tcp any host xxx.xxx.xxx.xxx eq 443
permit tcp any host xxx.xxx.xxx.xxx eq smtp
permit tcp any host xxx.xxx.xxx.xxx eq 143
permit tcp any host xxx.xxx.xxx.xxx eq 22
permit udp any host xxx.xxx.xxx.xxx eq domain
permit udp 192.5.41.40 0.0.0.1 eq ntp host xxx.xxx.xxx.xxx eq ntp
permit udp host 192.43.244.18 eq ntp host xxx.xxx.xxx.xxx eq ntp
permit tcp any host xxx.xxx.xxx.154 eq 1723
permit gre any host xxx.xxx.xxx.154
evaluate REFLEXIVE
deny ip any any log
ip access-list extended OUTBOUND
permit udp any any eq domain reflect REFLEXIVE
permit udp any any eq ntp reflect REFLEXIVE
permit icmp any any reflect REFLEXIVE
permit tcp any any eq ftp reflect REFLEXIVE
permit tcp any any eq ftp-data reflect REFLEXIVE
permit ip any any
ip access-list extended VALIDNAT
permit ip 10.0.0.0 0.0.0.255 any
permit ip 192.168.254.0 0.0.0.255 any
logging facility local6
logging source-interface Ethernet0
logging 10.0.0.15
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 24 permit 10.0.0.0 0.0.0.255
access-list 101 permit tcp any any eq smtp
access-list 101 permit tcp any eq smtp any
access-list 101 permit ip 148.89.0.0 0.0.255.255 any
access-list 102 permit ip host 10.0.0.18 any
access-list 102 permit ip any host 10.0.0.18
access-list 102 permit ip host xxx.xxx.xxx.xxx any
access-list 102 permit ip any host xxx.xxx.xxx.xxx
access-list 120 permit gre any host xxx.xxx.xxx.xxx
priority-list 1 protocol ip high list 102
snmp-server community XXX
snmp-server location XXX
snmp-server enable traps tty
radius-server host 10.0.0.17 auth-port 1812 acct-port 1813 key 7
radius-server retransmit 3
banner motd ^CC
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! THIS IS A PRIVATE SYSTEM !!
!! !!
!! UNAUTHORIZED USE IS !!
!! STRICTLY PROHIBITED !!
!! AND WILL BE PROSECUTED !!
!! TO THE FULL EXTENT ALLOWED !!
!! UNDER US AND/OR !!
!! INTERNATIONAL LAWS. !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
^C
!
line con 0
exec-timeout 0 0
password 7
line vty 0 4
password 7
!
ntp clock-period 17180485
ntp source Ethernet0
ntp access-group peer 24
ntp master 2
ntp server 192.5.41.41 source Ethernet1 prefer
ntp server 192.5.41.40 source Ethernet1 prefer
ntp server 192.43.244.18 source Ethernet1 prefer
end

 

[geirendre]

Can it be that your ACL is denying ICMP messages to get trough?
Try permiting ICMP packets of the type "packet-too-big", and "source-quench" this has to do with MTU's and queue's in the net.
Could be a problem during large file transmissions...
Hope this helps

 

[baddos]

Thinking it might be a CPU utilization problem... You seem to be doing a lot with such a small router.

Try adding "no ip unreachables" to your ethernet0 and ethernet1 interfaces.

Also a "show proc cpu" would be helpful.

 

[sames4239]

These are good ideas. I'm not much of a router guru yet so I need a few days to figure out how to do that.

Here is the show proc cpu

CPU utilization for five seconds: 9%/0%; one minute: 8%; five minutes: 15%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
1 0 1 0 0.00% 0.00% 0.00% 0 Chunk Manager
2 1755160 4905182 357 0.00% 0.00% 0.00% 0 Load Meter
3 1008 190 5305 8.01% 1.49% 0.32% 1 Virtual Exec
4 1365913020 58128050 23498 0.00% 4.01% 5.56% 0 Check heaps
5 4 7 571 0.00% 0.00% 0.00% 0 Chunk Manager
6 644 281 2291 0.00% 0.00% 0.00% 0 Pool Manager
7 0 2 0 0.00% 0.00% 0.00% 0 Timers
8 0 2 0 0.00% 0.00% 0.00% 0 Serial Backgroun
9 3173972 1554274 2042 0.00% 0.01% 0.00% 0 ARP Input
10 4 2 2000 0.00% 0.00% 0.00% 0 DDR Timers
11 0 2 0 0.00% 0.00% 0.00% 0 Dialer event
12 0 1 0 0.00% 0.00% 0.00% 0 Entity MIB API
13 0 1 0 0.00% 0.00% 0.00% 0 SERIAL A'detect
14 0 1 0 0.00% 0.00% 0.00% 0 Critical Bkgnd
15 2669940 3058496 872 0.08% 0.01% 0.00% 0 Net Background
16 457060 930691 491 0.00% 0.00% 0.00% 0 Logger
17 4516504 24501232 184 0.00% 0.03% 0.00% 0 TTY Background
18 5458708 24501271 222 0.00% 0.05% 0.05% 0 Per-Second Jobs
19 4 2 2000 0.00% 0.00% 0.00% 0 AAA Dictionary R
20 0 1 0 0.00% 0.00% 0.00% 0 Net Input
21 1263884 4905182 257 0.00% 0.00% 0.00% 0 Compute load avg
22 22132400 408559 54172 0.00% 0.05% 0.05% 0 Per-minute Jobs
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
23 238333628 97022410 2456 0.40% 0.01% 5.16% 0 IP Input
24 2533668 2826817 896 0.00% 0.01% 0.00% 0 CDP Protocol
25 0 1 0 0.00% 0.00% 0.00% 0 X.25 Encaps Mana
26 0 1 0 0.00% 0.00% 0.00% 0 PPP IP Add Route
27 11635820 429245 27107 0.65% 0.07% 0.01% 0 IP Background
28 177744 408591 435 0.00% 0.00% 0.00% 0 IP RIB Update
29 604 1492 404 0.00% 0.00% 0.00% 0 TCP Timer
30 364 65 5600 0.00% 0.00% 0.00% 0 TCP Protocols
31 0 1 0 0.00% 0.00% 0.00% 0 Probe Input
32 0 1 0 0.00% 0.00% 0.00% 0 RARP Input
33 0 1 0 0.00% 0.00% 0.00% 0 HTTP Timer
34 0 1 0 0.00% 0.00% 0.00% 0 Socket Timers
35 1024 321 3190 0.00% 0.00% 0.00% 0 DHCPD Receive
36 1372184 408503 3359 0.08% 0.00% 0.00% 0 IP Cache Ager
37 0 1 0 0.00% 0.00% 0.00% 0 PAD InCall
38 0 2 0 0.00% 0.00% 0.00% 0 X.25 Background
39 0 1 0 0.00% 0.00% 0.00% 0 COPS
40 2970200 408551 7270 0.16% 0.01% 0.00% 0 Adj Manager
41 256 98 2612 0.00% 0.00% 0.00% 0 AAA Accounting
42 0 2 0 0.00% 0.00% 0.00% 0 Crypto Support
43 212 217 976 0.00% 0.00% 0.00% 0 Crypto ACL
44 0 1 0 0.00% 0.00% 0.00% 0 Encrypt Proc
45 12 5 2400 0.00% 0.00% 0.00% 0 Key Proc
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
46 0 3 0 0.00% 0.00% 0.00% 0 Crypto CA
47 467500 1634014 286 0.00% 0.00% 0.00% 0 Crypto IKMP
48 156988 3816334 41 0.00% 0.00% 0.00% 0 IPSEC key engine
49 0 1 0 0.00% 0.00% 0.00% 0 IPSEC manual key
50 0 1 0 0.00% 0.00% 0.00% 0 Syslog Traps
51 1027856 4902006 209 0.00% 0.00% 0.00% 0 L2F management d
52 0 1 0 0.00% 0.00% 0.00% 0 L2F data daemon
53 0 1 0 0.00% 0.00% 0.00% 0 L2TP data daemon
54 0 1 0 0.00% 0.00% 0.00% 0 L2TP mgmt daemon
55 0 1 0 0.00% 0.00% 0.00% 0 PPPOE discovery
56 0 1 0 0.00% 0.00% 0.00% 0 PPPOE background
57 12 1 12000 0.00% 0.00% 0.00% 0 PPTP Mgmt
58 4 2 2000 0.00% 0.00% 0.00% 0 PPTP Data
59 0 1 0 0.00% 0.00% 0.00% 0 TCP Driver
60 0 1 0 0.00% 0.00% 0.00% 0 TCP Listener
61 1112400 3510503 316 0.00% 0.00% 0.00% 0 IP NAT Ager
62 8536 21747 392 0.00% 0.00% 0.00% 0 traffic_shape
63 0 2 0 0.00% 0.00% 0.00% 0 CCP manager
64 0 2 0 0.00% 0.00% 0.00% 0 CCP reset pak
65 0 2 0 0.00% 0.00% 0.00% 0 PPP manager
66 359452 24504890 14 0.00% 0.00% 0.00% 0 Multilink PPP
67 8 2 4000 0.00% 0.00% 0.00% 0 Multilink PPP ou
68 0 2 0 0.00% 0.00% 0.00% 0 Multilink event
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
69 61784 704168 87 0.00% 0.00% 0.00% 0 IP RACL Ager
70 0 1 0 0.00% 0.00% 0.00% 0 SNMP Timers
71 8 2 4000 0.00% 0.00% 0.00% 0 IP SNMP
72 4 1 4000 0.00% 0.00% 0.00% 0 PDU DISPATCHER
73 0 1 0 0.00% 0.00% 0.00% 0 SNMP ENGINE
74 0 1 0 0.00% 0.00% 0.00% 0 SNMP ConfCopyPro
75 0 1 0 0.00% 0.00% 0.00% 0 SNMP Traps
76 1100 753 1460 0.00% 0.00% 0.00% 0 RADIUS
77 1360100 25094815 54 0.00% 0.00% 0.00% 0 NTP
78 17512 204436 85 0.00% 0.00% 0.00% 0 DHCPD Timer
79 1080044 6944520 155 0.00% 0.00% 0.00% 0 DHCPD Database

 

[geirendre]

Some of us might think about the ICMP-protocol as a hackers-protocol, but it can be a very important control protocol too. One of it's uses is that a receiving device can send a source-quench message back downstream to the sender of the data if it's receiving interface is starting to be congested. If these packets dont get trough back to the sender, the receiving interface will at some point overflow and packets get dropped, and maby the whole conversation halts.
This would produce a cenario like the one you describe.
Maby some packet-sniffing could tell you more about what is happening...

 

[bierhunter]

You may be experiencing retransmissions. If you could do a Show Buffers and post it here it may be useful. We may be able to tweak your memory buffers a little bit to help stabilize those downloads.

BierHunter
CNE, MCSE, CCNP

 

[sames4239]

Here are the buffers. I noticed some stuff in the big buffers and some fallbacks and misses. Is there any way to reset those counters? I can't tell how old those are.

Buffer elements:
499 in free list (500 max allowed)
235360025 hits, 0 misses, 0 created

Public buffer pools:
Small buffers, 104 bytes (total 50, permanent 50):
50 in free list (20 min, 150 max allowed)
7946158 hits, 0 misses, 0 trims, 0 created
0 failures (0 no memory)
Middle buffers, 600 bytes (total 25, permanent 25):
23 in free list (10 min, 150 max allowed)
1145356 hits, 0 misses, 0 trims, 0 created
0 failures (0 no memory)
Big buffers, 1536 bytes (total 50, permanent 50, peak 131 @ 2w3d):
50 in free list (5 min, 150 max allowed)
2541336 hits, 600 misses, 381 trims, 381 created
56 failures (0 no memory)
VeryBig buffers, 4520 bytes (total 0, permanent 0):
0 in free list (0 min, 100 max allowed)
0 hits, 0 misses, 0 trims, 0 created
0 failures (0 no memory)
Large buffers, 5024 bytes (total 0, permanent 0):
0 in free list (0 min, 10 max allowed)
0 hits, 0 misses, 0 trims, 0 created
0 failures (0 no memory)
Huge buffers, 18024 bytes (total 0, permanent 0, peak 2 @ 7w0d):
0 in free list (0 min, 4 max allowed)
0 hits, 3 misses, 6 trims, 6 created
0 failures (0 no memory)

Interface buffer pools:
Ethernet0 buffers, 1524 bytes (total 32, permanent 32):
8 in free list (0 min, 32 max allowed)
2090441 hits, 1639870 fallbacks
8 max cache size, 7 in cache
107586853 hits in cache, 3730088 misses in cache
Ethernet1 buffers, 1524 bytes (total 16, permanent 16):
5 in free list (0 min, 16 max allowed)
137510 hits, 61158 fallbacks
4 max cache size, 3 in cache
126538995 hits in cache, 198656 misses in cache

 

[bierhunter]

I ran your buffers output through Cisco's Output Interpreter. No real errors are shown, but there is a warning which may help regarding your Big Buffers.

This one seems to be the one having some slight issues. Not major problems, but it could affect traffic during heavy loads.

Big buffers, 1536 bytes (total 50, permanent 50, peak 131 @ 2w3d):
50 in free list (5 min, 150 max allowed)
2541336 hits, 600 misses, 381 trims, 381 created
56 failures (0 no memory)

Here's the diagnosis from Cisco:
-----------------------
WARNING: This router has dropped 56 packet(s) (0.0022%) due to a shortage of 'Big
buffers'.
'Failures' tracks the number of dropped packets due to unsuccessful attempts to
allocate a buffer. This can occur in spite of (or even because of) the router's
attempts to create additional free buffers when their number declines below minimum.
TRY THIS: Use the 'show memory' command to check the amount of free memory before
attempting to modify public pool buffers. Increase the minimum number of free buffers
for the affected pool.
The following are initial values that usually work well in buffer tuning:
-permanent: take the number of total buffers in a pool and add about 20%
-minimum: set min to about 20-30% of permanent
-maximum: set to something equal or greater than the sum of permanent and minimum
NOTE: This condition may also occur due to a temporary traffic burst.
CAUTION: Adjusting system buffers requires care, expertise, and follow-up monitoring.
Incorrect adjustments can severely affect hardware (and thus network) performance.
-------------------

Basically, you don't have a lot of problems; but bursts in traffic (like big downloads) may experience some problems.

These procedures may help with your Big buffer pool:

-permanent: take the number of total buffers in a pool and add about 20%
-minimum: set min to about 20-30% of permanent
-maximum: set to something equal or greater than the sum of permanent and minimum

In your case it would be:

conf t
buffers big perm 60
buffers big min-free 18
end

Your max looks ok (perm + min [or higher]).

You can tweak these a little more if necessary, but you don't want to allocate a whole bunch if it's not needed.

I've done this on several routers in the past, and have seen good improvement in the area you're experiencing.

Hope this helps.



BierHunter
CNE, MCSE, CCNP

 

[sames4239]

Sorry for the delay on this...

I tried BierHunter's advice about the Big buffers. No joy.

I am also looking at the advice above from geirendre and baddos.

The advice is to "Try permiting ICMP packets of the type "packet-too-big", and "source-quench" this has to do with MTU's and queue's in the net."

and

"Try adding "no ip unreachables" to your ethernet0 and ethernet1 interfaces."

Unfortunately, I am not much of a router Guru yet so I need help procedurally on how to do that. Can anyone help me with some step by step assistance or point me to some resources on how to do that? I am a little chicken playing on a production system. I am usually more brave on test equipment where the only cost for a mistake is my time.

Thanks,

Steve

 

[CartoonDog]

Hey Sames1, I am having the exact same problem with a Cisco 2611 router. Did you find a solution to the problem? Give me a hollar, I would like to compare configs.

Cartoondog@lpmachine.com

 

[Nettekkie1010]

The HTTP or FTP downloads are starting and getting through about 3-4MB so everything which supports those connections must be working; therefore the access-lists wouldn't seem to be the culprit. If it was an access-list it would most likely prevent the connection in the first place.

We had a problem similar to this where downloads would get to 3-4MB and quit. When I put the sniffer on the line I saw the remote node sending a RST; if you could sniff the connection I think you would see the same thing. Now, there aren't too many reasons the remote node would send a reset and basically boils down to not receiving the ACK packets in a timely manner. Ours was due to a dirty T1 on the outbound side.

You can and should sniff this connection. If you don't have a sniffer download Ethereal and WinPcap from the NET with the router removed and then put the router back in. From there:
1. Install both programs on the PC and start Ethereal data capture on the NIC in that PC.
2. Start the download and wait for it to fail.
3. Stop Ethereal, and the session data will be displayed. Be patient, it's slow processing the initial display.
4. Highlight one of the packets associated with the session which just failed.
5. On the Ethereal menu click TOOLS/TCP Stream Analysis

When you examine the decode the answer should become apparent.

I don't recommend hunt-and-peck troubleshooting where you pick the most likely cause and see if it works. Instead, take the time to gather hard evidence and evaluate that because it usually takes less time. And you learn more.

 

[sames4239]

Thank you for the advice with Ethereal. I did as you said and I noticed two things:

1. I get a lot of ACK's during the download. (Presumably to acknowledge the remote web server that I got the packets it sent. Problems arise after few minutes and a few megabytes into the download when I start getting duplicate ACK's with really high RTT's.

2. It does 35 duplicate ACK's and then goes to RST until I stop the transfer.

I'm not too sure what is going on here. Does anyone have any ideas?

Thanks,

Steve

 

[Nettekkie1010]

FTP is a reliable connection where every packet sent has to be acknowledged so a lot of them should be expected. One thing you should not see however, is a high rate of duplicate ACK's.

Can you attach a snippet from the Ethereal trace which shows a few packets around the time you start to get duplicate ACK's and also around the RST packet?

 

[sames4239]

Here is the dump from the last few good packets going into the duplicates. I have added a few RST's at the end.

Thanks for taking time to help me.

Thanks,

Steve

No. Time Source Destination Protocol Info
5314 60.236995 192.150.18.29 10.0.0.100 HTTP Continuation

Frame 5314 (1414 bytes on wire, 1414 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.026582000
Time delta from previous packet: 0.017156000 seconds
Time since reference or first frame: 60.236995000 seconds
Frame Number: 5314
Packet Length: 1414 bytes
Capture Length: 1414 bytes
Ethernet II, Src: 00:10:7b:f9:14:d4, Dst: 00:07:e9:08:d3:f5
Destination: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Source: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.150.18.29 (192.150.18.29), Dst Addr: 10.0.0.100 (10.0.0.100)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1400
Identification: 0x042a (1066)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 52
Protocol: TCP (0x06)
Header checksum: 0x603f (correct)
Source: 192.150.18.29 (192.150.18.29)
Destination: 10.0.0.100 (10.0.0.100)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1234 (1234), Seq: 4684711, Ack: 563, Len: 1360
Source port: http (80)
Destination port: 1234 (1234)
Sequence number: 4684711 (relative sequence number)
Next sequence number: 4686071 (relative sequence number)
Acknowledgement number: 563 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6744
Checksum: 0xb630 (correct)
Hypertext Transfer Protocol
Data (1360 bytes)

0000 01 60 a5 80 9b 84 55 7b 70 e2 4f 3a 2f 4c 6f 19 .`....U{p.O:/Lo.
0010 be 4d 72 44 64 9e 4e 1b e1 ca e3 b2 20 ed ef e8 .MrDd.N..... ...
0020 e0 a8 ee f7 ca ea 69 fd e0 df 1a e4 04 c9 85 35 ......i........5
0030 92 5f 55 71 07 7f 10 1d ca 65 49 88 40 a6 e9 fc ._Uq.....eI.@...
0040 47 3e 5b f7 8c 55 62 b4 41 ae 00 49 11 9e b1 99 G>[..Ub.A..I....
0050 66 55 19 d5 41 49 32 ab 61 d5 10 cc c1 7c 5a c6 fU..AI2.a....|Z.
0060 65 ec 62 ab c6 a6 a8 64 c4 57 9d 69 34 0d 25 44 e.b....d.W.i4.%D
0070 ac 05 53 a9 18 f2 b7 b6 87 53 94 61 3e be 9f 60 ..S......S.a>..`
0080 12 f0 07 19 25 8e c4 05 e7 a1 be 4d 0e 16 09 4b ....%......M...K
0090 22 41 46 a3 94 41 27 0f b9 40 5b f7 55 4e d5 65 "AF..A'..@[.UN.e
00a0 73 b0 a3 74 63 2f 99 4b 55 07 a6 dd 73 dd 13 74 s..tc/.KU...s..t
00b0 76 d0 bb cd 48 38 5d 56 62 d1 ae e5 a8 2e ba c3 v...H8]Vb.......
00c0 ba 40 b6 6a b8 62 19 fe fe 0e cc ea 46 3a a9 6e .@.j.b......F:.n
00d0 37 9f ae be fa 97 c2 bb 6d d4 5f 76 b4 88 b8 9c 7.......m._v....
00e0 b7 74 4b ff 4c ca c5 41 51 d4 3f bf 95 66 dd 8d .tK.L..AQ.?..f..
00f0 ef 3a cd c6 b1 b8 95 35 67 ce 3f bf 29 5a a6 1e .:.....5g.?.)Z..
0100 51 e4 53 4b 27 d1 78 2c cd 68 91 0c d5 e7 a7 19 Q.SK'.x,.h......
0110 a5 91 10 e1 a7 c4 13 51 02 8f 01 04 52 9d 79 42 .......Q....R.yB
0120 27 66 fa 79 9f d4 cf 8a 4c 38 00 8a 05 c5 2f 3d 'f.y....L8..../=
0130 7c 3b 17 1d 7c a9 21 ad c9 d1 7c 26 49 48 0e 44 |;..|.!...|&IH.D
0140 97 c4 db 0a 20 b0 8c 05 44 10 17 60 65 fd 28 c5 .... ...D..`e.(.
0150 48 c1 a5 2a 94 c2 15 be 7b 23 d0 c5 71 9f 57 f2 H..*....{#..q.W.
0160 2d 88 8a 91 91 35 70 c6 54 2d 03 b6 c6 8d 0d c4 -....5p.T-......
0170 1a 6a af de 7c 8a f4 f3 c0 ae d2 79 be c0 8b 30 .j..|......y...0
0180 14 30 2d 06 47 9e 22 0e 6a 11 13 15 72 ea 9a 6a .0-.G.".j...r..j
0190 9f 99 b4 a2 01 d4 0e 60 44 3e a4 1e 61 48 7e 04 .......`D>..aH~.
01a0 32 6c 4b f8 58 67 26 e0 76 81 a8 9c e1 ca 1d e5 2lK.Xg&.v.......
01b0 d8 01 26 9d d7 78 f0 45 37 af bd 0b df c8 ba d0 ..&..x.E7.......
01c0 b5 f7 ac 90 03 6f dc 59 1f 28 df 82 f4 c3 1c 8d .....o.Y.(......
01d0 ec d5 2c 62 18 37 3d 3e eb a8 34 12 8f 88 c3 0a ..,b.7=>..4.....
01e0 59 34 ae 75 7e 96 72 92 2a d1 eb 29 75 b2 96 6b Y4.u~.r.*..)u..k
01f0 0b 69 f0 e0 c7 ec 88 a8 10 3d 8a 16 b4 76 fb 40 .i.......=...v.@
0200 79 18 eb 88 5a 93 42 76 6e 60 f6 9f 54 11 8f ab y...Z.Bvn`..T...
0210 6d aa 0f d8 14 cc 9d 18 af 60 cf 50 99 88 6d fc m........`.P..m.
0220 02 be 0b ca 04 86 b0 0d 74 ad 3f 96 9e d8 e3 f8 ........t.?.....
0230 f0 18 3c a8 f1 70 fb 1f 8c 7a f7 8a 2f aa 54 83 ..<..p...z../.T.
0240 c9 f2 ed 63 2f 2d 10 fc c0 63 d8 a1 ea d4 81 08 ...c/-...c......
0250 3f ad dd a9 47 d5 89 02 1e 05 6e e4 7c 05 db 42 ?...G.....n.|..B
0260 d6 72 71 4e 92 03 08 43 e1 89 f9 3d c1 4f b6 64 .rqN...C...=.O.d
0270 74 ee de 9c e1 cc 05 8c ec 00 97 45 25 f5 81 96 t..........E%...
0280 18 47 32 c1 1b d6 05 97 04 9c 5f 54 81 ef 25 be .G2......._T..%.
0290 59 b0 0f 6a 89 53 59 06 f7 07 9e 12 f8 09 a8 08 Y..j.SY.........
02a0 2e 0b ad 82 04 a0 bb 73 e7 94 45 c6 91 4e f0 a9 .......s..E..N..
02b0 26 14 63 18 99 80 61 b4 53 f2 7d b7 69 01 6e e4 &.c...a.S.}.i.n.
02c0 e3 8a cd 06 78 20 c2 1a b3 41 e9 15 dd 25 e6 9a ....x ...A...%..
02d0 4f 9e 57 9a 3e 23 75 4e 6c 58 d6 d3 e7 d3 91 0e O.W.>#uNlX......
02e0 0e da 5b 9d c0 53 01 ca 50 e4 d7 3b 8c 97 5a 93 ..[..S..P..;..Z.
02f0 8e ac df 19 38 57 6a 9d b9 f3 d7 b0 07 86 d4 b8 ....8Wj.........
0300 a0 63 5a eb 1e 4c 4c 60 5b bb 77 59 22 f8 2c 69 .cZ..LL`[.wY".,i
0310 ff 0e 6c df 44 8f 76 53 15 d8 4f ca 37 92 7f b8 ..l.D.vS..O.7...
0320 8b cc c5 54 10 af 93 af e2 f5 a6 b5 49 07 15 da ...T........I...
0330 4c 54 af d5 2a 97 78 3a 1e cc f0 c0 2d 02 4c e3 LT..*.x:....-.L.
0340 14 88 d7 cb d8 7d 3f 4d 9f 94 b1 ad 14 e0 af 30 .....}?M.......0
0350 97 7d 8b 53 c9 38 52 46 31 d6 6c 06 6e 42 e4 4c .}.S.8RF1.l.nB.L
0360 72 88 a5 2f ce df 5f d1 34 8a 14 6f 3d 65 16 b3 r../.._.4..o=e..
0370 4b 73 ce ad 13 45 58 37 3c e2 02 be 78 28 c3 05 Ks...EX7<...x(..
0380 1e 2f 62 6b 93 9e 76 68 1b 2e fc 32 b4 f0 42 8c ./bk..vh...2..B.
0390 71 e4 1e c2 91 90 29 b5 3d 48 f6 c8 96 e7 bd 70 q.....).=H.....p
03a0 78 8d 65 bb 80 73 7f 27 30 39 7b c2 9b 38 f3 9c x.e..s.'09{..8..
03b0 96 3b 4a 46 30 4f b7 ee 35 5f 6e 86 6d 3e 4e a4 .;JF0O..5_n.m>N.
03c0 d4 99 2d 93 f9 9e 66 f8 3b 72 10 74 3d 2a da 8a ..-...f.;r.t=*..
03d0 75 7c 75 df 2e 64 8e 42 e8 47 1d 05 5c be 7b 37 u|u..d.B.G..\.{7
03e0 b5 f8 92 33 f2 4c 5b 29 4c 6c 06 92 ad 52 d2 1f ...3.L[)Ll...R..
03f0 e7 53 d6 42 25 e9 8c 05 f6 f2 2d f8 cd 7c 51 b0 .S.B%.....-..|Q.
0400 b3 ab 23 67 90 7f f6 89 48 b9 dd 32 df 56 24 19 ..#g....H..2.V$.
0410 26 c1 1f d0 0a 62 c9 8c b8 74 46 05 6a 9f f7 e4 &....b...tF.j...
0420 3c 4b a5 2e 9e cd db 79 12 fb c1 f0 68 2d ba 12 <K.....y....h-..
0430 b7 3c 12 64 20 2f 62 51 cc e5 88 26 cf 65 5d a9 .<.d /bQ...&.e].
0440 5a 5b 58 9f a7 b7 67 9b 53 2c d0 7e 1f 89 4c ed Z[X...g.S,.~..L.
0450 70 99 1a 0c 16 16 9e 3c 9b 86 62 fe 90 0d fc 30 p......<..b....0
0460 67 c5 51 d8 38 eb 4e 74 60 cd 00 d0 01 ef c3 48 g.Q.8.Nt`......H
0470 7f 8c cf b0 33 e1 92 53 b2 92 89 67 ac 41 d3 d2 ....3..S...g.A..
0480 18 ea 70 a5 8e b9 0b 68 29 1f 06 2e ab 7a fe ce ..p....h)....z..
0490 36 eb a9 8d 90 36 99 f9 eb aa 47 73 ad ad a6 07 6....6....Gs....
04a0 7e d5 be 25 6b 79 3b 41 b9 c6 2e c1 36 db fc 9b ~..%ky;A....6...
04b0 df cf 3e c2 32 79 75 97 02 18 87 24 39 59 ab fe ..>.2yu....$9Y..
04c0 a3 7d da f0 4a 9a b3 60 90 ca d4 ff 7f dc 13 ea .}..J..`........
04d0 13 f0 4d 65 97 0a 42 1e 75 b7 b9 e7 61 c2 82 d5 ..Me..B.u...a...
04e0 39 52 27 b4 60 71 f5 58 6b 95 74 d8 a9 f1 5b 52 9R'.`q.Xk.t...[R
04f0 e3 b5 7e 21 2b 71 1e 69 58 72 3a 28 bb 21 89 42 ..~!+q.iXr.!.B
0500 ee 81 99 3f 5c a5 73 6f cd 46 64 cc 1d 86 ee e8 ...?\.so.Fd.....
0510 8c ab 20 62 be e0 00 21 d8 fe d2 5f 51 b4 14 8e .. b...!..._Q...
0520 ee 1e 67 be dc 92 f7 ad 40 3c 64 eb 1a fc 2a 8e ..g.....@<d...*.
0530 58 19 ef 52 69 60 55 2f 3d 50 5a ab 06 43 75 a5 X..Ri`U/=PZ..Cu.
0540 6b d3 f7 25 b1 20 a4 55 6c 31 4a 28 70 45 40 83 k..%. .Ul1J(pE@.

No. Time Source Destination Protocol Info
5315 60.416413 10.0.0.100 192.150.18.29 TCP 1234 > http [ACK] Seq=563 Ack=4686071 Win=256960 [CHECKSUM INCORRECT] Len=0

Frame 5315 (54 bytes on wire, 54 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.206000000
Time delta from previous packet: 0.179418000 seconds
Time since reference or first frame: 60.416413000 seconds
Frame Number: 5315
Packet Length: 54 bytes
Capture Length: 54 bytes
Ethernet II, Src: 00:07:e9:08:d3:f5, Dst: 00:10:7b:f9:14:d4
Destination: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Source: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.0.100 (10.0.0.100), Dst Addr: 192.150.18.29 (192.150.18.29)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x226c (8812)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x0000 (incorrect, should be 0x3b4d)
Source: 10.0.0.100 (10.0.0.100)
Destination: 192.150.18.29 (192.150.18.29)
Transmission Control Protocol, Src Port: 1234 (1234), Dst Port: http (80), Seq: 563, Ack: 4686071, Len: 0
Source port: 1234 (1234)
Destination port: http (80)
Sequence number: 563 (relative sequence number)
Acknowledgement number: 4686071 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 256960
Checksum: 0xdd31 (incorrect, should be 0xfd45)
SEQ/ACK analysis
This is an ACK to the segment in frame: 5314
The RTT to ACK the segment was: 0.179418000 seconds

No. Time Source Destination Protocol Info
5316 60.422798 192.150.18.29 10.0.0.100 HTTP Continuation

Frame 5316 (1414 bytes on wire, 1414 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.212385000
Time delta from previous packet: 0.006385000 seconds
Time since reference or first frame: 60.422798000 seconds
Frame Number: 5316
Packet Length: 1414 bytes
Capture Length: 1414 bytes
Ethernet II, Src: 00:10:7b:f9:14:d4, Dst: 00:07:e9:08:d3:f5
Destination: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Source: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.150.18.29 (192.150.18.29), Dst Addr: 10.0.0.100 (10.0.0.100)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1400
Identification: 0x0435 (1077)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 52
Protocol: TCP (0x06)
Header checksum: 0x6034 (correct)
Source: 192.150.18.29 (192.150.18.29)
Destination: 10.0.0.100 (10.0.0.100)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1234 (1234), Seq: 4699671, Ack: 563, Len: 1360
Source port: http (80)
Destination port: 1234 (1234)
Sequence number: 4699671 (relative sequence number)
Next sequence number: 4701031 (relative sequence number)
Acknowledgement number: 563 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6744
Checksum: 0xb37b (correct)
SEQ/ACK analysis
TCP Analysis Flags
A segment before this frame was lost
Hypertext Transfer Protocol
Data (1360 bytes)

0000 98 28 99 9a 81 4e 80 c1 bc 98 d0 b8 af ce 42 36 .(...N........B6
0010 c7 05 05 71 88 69 7e e1 be 38 b2 64 2d 0e 41 43 ...q.i~..8.d-.AC
0020 1b 2b af b8 91 e7 aa b8 6b 0f 1d 7f 59 c6 61 38 .+......k...Y.a8
0030 bf 06 5b 71 17 03 4b 07 55 6d 6e 16 72 b8 26 4e ..[q..K.Umn.r.&N
0040 c4 12 c5 4c 25 84 45 9c 5e a9 a5 7d 98 a0 d2 d1 ...L%.E.^..}....
0050 0a 4c 03 a5 3e 11 ef 28 31 2a f8 50 c5 42 ba 7e .L..>..(1*.P.B.~
0060 a1 eb 9f 0e 5c 92 b8 05 83 61 1c 4f 64 6f 36 bb ....\....a.Odo6.
0070 fa 6a 66 0d 30 3d 51 28 f1 d6 c7 46 67 60 df 4d .jf.0=Q(...Fg`.M
0080 b7 9f 8a 7e ed 1d f7 74 f2 39 51 2e a2 69 91 23 ...~...t.9Q..i.#
0090 ac 19 6b 52 2f eb 46 0a 6c ce ad 9c f0 60 70 a7 ..kR/.F.l....`p.
00a0 76 d4 ca 85 3c 13 6c 56 b6 4c dd bc 3d 3a 65 2f v...<.lV.L..=:e/
00b0 4b 5e 23 5f 0f 71 08 b3 39 0e f0 7a 94 43 6c 86 K^#_.q..9..z.Cl.
00c0 c2 e0 19 a4 33 a1 32 4d c5 d4 71 1a 1f 8b a0 3a ....3.2M..q....:
00d0 d0 99 f3 40 db 77 01 2f 14 15 5e e6 44 3e 64 42 ...@.w./..^.D>dB
00e0 7e 1e c8 ed 3b 5e f1 18 8f e3 b2 a7 5e 29 dd 69 ~...;^......^).i
00f0 c6 e2 0b cd 9a f9 11 95 0b 75 fa 99 19 d7 4a e1 .........u....J.
0100 89 9a d4 c4 ca b2 da 7f 2e f1 9d 7c e7 23 b6 07 ...........|.#..
0110 ae d2 ac e9 76 b2 9e 6d 68 1f 2a 4f f8 aa 11 9d ....v..mh.*O....
0120 10 4a c5 0b 8f eb 99 a0 28 11 47 c4 03 02 8a 8b .J......(.G.....
0130 97 e2 81 9e 07 e7 95 e1 16 19 6f 75 88 95 d8 e7 ..........ou....
0140 14 0e 31 e2 87 69 4d 76 4b a4 8f 46 fc 3b 86 94 ..1..iMvK..F.;..
0150 7e 8a 9d c6 90 36 de 1d 95 8a f2 14 14 fd 8a 97 ~....6..........
0160 e7 c5 25 74 8c ff da 65 75 e5 8d 41 d3 76 3a 44 ..%t...eu..A.v
0170 28 fd 4e 1e b9 be c6 43 85 2d 96 34 1a 2f a1 8b (.N....C.-.4./..
0180 b9 26 72 ef aa 53 44 19 7d e2 89 cb 73 49 1d c7 .&r..SD.}...sI..
0190 c8 63 38 66 d5 b6 e1 ee 47 1b 14 a8 23 39 96 a6 .c8f....G...#9..
01a0 9f 43 58 d7 1a 68 e5 d1 13 8e f0 a6 a2 39 05 8a .CX..h.......9..
01b0 91 93 c9 ad e5 50 55 dd b5 76 21 17 8d d0 cb 5b .....PU..v!....[
01c0 4c 7d f3 10 02 1a 44 82 c8 12 93 f8 9c a8 1a c3 L}....D.........
01d0 b6 9c 93 01 8a 03 c2 56 da ba 9c ba 44 dd 2d 68 .......V....D.-h
01e0 0f a3 eb 49 c4 77 34 b7 54 ad ac f6 d4 c3 d7 73 ...I.w4.T......s
01f0 60 80 1e 27 b5 3e 2a e8 2a 92 aa 77 7e 28 1d 5d `..'.>*.*..w~(.]
0200 9a 7d e0 0a c4 23 d5 0a b5 09 75 07 d9 e5 95 85 .}...#....u.....
0210 56 7a a7 07 da ed 1c fe 52 15 84 90 e7 da 20 91 Vz......R..... .
0220 ce 7d ed f3 3c e0 f5 4d 88 2d 29 97 4e 65 29 74 .}..<..M.-).Ne)t
0230 df ef 87 eb 0f 7d c0 8d cd 4e 89 f9 dd bf fb 34 .....}...N.....4
0240 81 1e f0 16 50 11 17 ab f3 f4 7a 58 3a 9d a4 0c ....P.....zX:...
0250 32 85 79 80 98 5a 88 f0 b6 5c 0c c1 85 68 5f 89 2.y..Z...\...h_.
0260 26 36 c5 82 c5 cc 11 40 91 5d 1a 96 6d 94 f9 27 &6.....@.]..m..'
0270 41 8a 61 c6 11 fa da f4 98 2a 97 00 58 30 cb c5 A.a......*..X0..
0280 0f 00 e6 45 78 76 98 30 c9 d1 76 b3 c0 be 1c 60 ...Exv.0..v....`
0290 54 62 14 97 80 28 5f 11 6c 00 10 d2 44 ff 48 f1 Tb...(_.l...D.H.
02a0 14 f8 be 4e bc 20 0a 09 ee e0 dd 5a 3e 6c 63 6c ...N. .....Z>lcl
02b0 3f fc 4f f8 03 36 a4 df 2b 14 25 8a 7e 18 16 37 ?.O..6..+.%.~..7
02c0 23 16 ef 6c b9 c9 b6 2c 2c 6e 1c af 77 b6 61 dc #..l...,,n..w.a.
02d0 4b b3 1a ae 83 7b 49 5c 48 de 18 bf 3b 02 92 84 K....{I\H...;...
02e0 34 ec 29 6a ea db 4a 54 cc 10 59 f0 c9 1e 77 a6 4.)j..JT..Y...w.
02f0 ab eb 06 37 5b c3 b2 05 17 77 54 89 6e e7 89 50 ...7[....wT.n..P
0300 a6 b0 64 5f 17 ca 87 b6 ea 16 0c 86 21 54 93 b2 ..d_........!T..
0310 43 41 3c 21 f2 7b 1c a7 d2 99 03 e6 3c bc a8 ab CA<!.{......<...
0320 24 67 93 92 e6 cf db 6e 95 cf 34 c9 68 69 a6 98 $g.....n..4.hi..
0330 23 e2 a4 67 35 94 15 e7 b3 fb 99 c0 3d b5 ee 6d #..g5.......=..m
0340 b4 e2 2b 0e 41 84 e1 96 ec fb 5f ff 0b e1 8b 45 ..+.A....._....E
0350 9d 25 82 69 73 8b c3 1c b6 71 80 6d cd 9f db 12 .%.is....q.m....
0360 e5 a4 5d 75 52 c8 cc 68 e6 38 cb af 45 28 fd 12 ..]uR..h.8..E(..
0370 75 d6 16 e7 d8 d2 bc c0 c3 2b 68 17 af a4 9b e2 u........+h.....
0380 9f 09 c8 5c 06 54 55 e9 19 97 4b a9 fb 13 a2 56 ...\.TU...K....V
0390 17 c7 f4 37 a6 80 9f 0a 62 69 a3 e8 be 29 b0 00 ...7....bi...)..
03a0 47 84 ce e1 f2 31 93 0c 54 f4 97 f9 a0 51 7a 06 G....1..T....Qz.
03b0 e6 9f 88 9b fc 07 52 fe 72 7d ca 9c 22 da f3 62 ......R.r}.."..b
03c0 c9 f6 97 57 64 f4 5e cb 5f 17 84 e6 f0 9d 6c 98 ...Wd.^._.....l.
03d0 0c a6 44 c9 6f c0 f1 39 7d cf 79 da 67 02 f2 91 ..D.o..9}.y.g...
03e0 bd a0 86 6f fb 51 ae 7d 8b c9 04 c7 3f 00 1b 65 ...o.Q.}....?..e
03f0 a2 ec 2d 02 7d 82 e6 6f 94 6b 3a a3 42 b2 f7 bf ..-.}..o.k:.B...
0400 7e e7 46 ac a5 36 54 89 40 34 22 fb ba fa 18 b3 ~.F..6T.@4".....
0410 e4 b7 0d 1a 38 f6 2d 77 a1 6d 2a fc c9 0d d5 1e ....8.-w.m*.....
0420 da 92 25 68 bf 9d 85 b4 f5 68 30 57 44 78 b7 4f ..%h.....h0WDx.O
0430 94 9d 28 11 53 72 08 d6 43 a7 8c 65 09 ca 39 15 ..(.Sr..C..e..9.
0440 fe 49 b3 75 fd c9 c1 07 fb 00 4b df 9c da a4 fd .I.u......K.....
0450 4e 7c 56 49 e1 d7 25 47 ce d1 b0 7a 25 55 fc 03 N|VI..%G...z%U..
0460 72 5e e3 65 48 f3 a7 ce 1d 4f 8e 3e 10 ea f6 6a r^.eH....O.>...j
0470 6a e4 94 44 b6 5e 00 bf 69 de 84 1c 48 37 50 9e j..D.^..i...H7P.
0480 0a ee f3 49 25 8e 53 f5 5d 3c 65 11 32 a6 a1 63 ...I%.S.]<e.2..c
0490 d5 53 94 d0 a5 15 e2 26 a1 14 2d df 80 8c e2 9a .S.....&..-.....
04a0 9e 5f 3e 09 2c e3 79 db 84 34 a7 3f 58 09 a7 47 ._>.,.y..4.?X..G
04b0 40 21 39 db 8b ce f8 c7 ac 14 14 73 f2 a1 12 51 @!9........s...Q
04c0 09 44 e5 a5 70 72 79 14 52 8c 5f 37 67 43 3e ff .D..pry.R._7gC>.
04d0 aa dd 62 9f 5b 24 61 80 db 4a 38 d4 33 ab 71 ca ..b.[$a..J8.3.q.
04e0 79 44 e0 8b 37 38 ca f0 ff d0 97 10 75 41 e1 7d yD..78......uA.}
04f0 05 03 86 28 c2 f8 cd e4 6d 28 ae 1d f0 0d 8c 0a ...(....m(......
0500 51 d4 95 08 11 e9 c0 48 93 b7 90 eb 8b a0 39 62 Q......H......9b
0510 21 55 f1 a9 a2 17 f7 92 84 bc 20 4f ec 1e e5 1a !U........ O....
0520 06 02 fb a6 d5 e6 6a d0 94 d3 17 e5 8e e8 a7 7b ......j........{
0530 ca 42 78 93 9c 21 fa f6 ef 67 80 9e ed fe 8a 47 .Bx..!...g.....G
0540 b6 c3 f0 8a dc 5d cc 51 8a 8e 68 d0 05 12 df 58 .....].Q..h....X

No. Time Source Destination Protocol Info
5317 60.422822 10.0.0.100 192.150.18.29 TCP [TCP Dup ACK 5315#1] 1234 > http [ACK] Seq=563 Ack=4686071 Win=256960 [CHECKSUM INCORRECT] Len=0 SLE=2950856453 SRE=2950857813

Frame 5317 (66 bytes on wire, 66 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.212409000
Time delta from previous packet: 0.000024000 seconds
Time since reference or first frame: 60.422822000 seconds
Frame Number: 5317
Packet Length: 66 bytes
Capture Length: 66 bytes
Ethernet II, Src: 00:07:e9:08:d3:f5, Dst: 00:10:7b:f9:14:d4
Destination: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Source: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.0.100 (10.0.0.100), Dst Addr: 192.150.18.29 (192.150.18.29)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x226d (8813)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x0000 (incorrect, should be 0x3b40)
Source: 10.0.0.100 (10.0.0.100)
Destination: 192.150.18.29 (192.150.18.29)
Transmission Control Protocol, Src Port: 1234 (1234), Dst Port: http (80), Seq: 563, Ack: 4686071, Len: 0
Source port: 1234 (1234)
Destination port: http (80)
Sequence number: 563 (relative sequence number)
Acknowledgement number: 4686071 (relative ack number)
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 256960
Checksum: 0xdd3d (incorrect, should be 0x640e)
Options: (12 bytes)
NOP
NOP
SACK:
left edge = 2950856453
right edge = 2950857813
SEQ/ACK analysis
The RTT to ACK the segment was: 1089673174.212409000 seconds
TCP Analysis Flags
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 5315

No. Time Source Destination Protocol Info
5318 60.435863 192.150.18.29 10.0.0.100 HTTP Continuation

Frame 5318 (1414 bytes on wire, 1414 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.225450000
Time delta from previous packet: 0.013041000 seconds
Time since reference or first frame: 60.435863000 seconds
Frame Number: 5318
Packet Length: 1414 bytes
Capture Length: 1414 bytes
Ethernet II, Src: 00:10:7b:f9:14:d4, Dst: 00:07:e9:08:d3:f5
Destination: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Source: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.150.18.29 (192.150.18.29), Dst Addr: 10.0.0.100 (10.0.0.100)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1400
Identification: 0x0436 (1078)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 52
Protocol: TCP (0x06)
Header checksum: 0x6033 (correct)
Source: 192.150.18.29 (192.150.18.29)
Destination: 10.0.0.100 (10.0.0.100)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1234 (1234), Seq: 4701031, Ack: 563, Len: 1360
Source port: http (80)
Destination port: 1234 (1234)
Sequence number: 4701031 (relative sequence number)
Next sequence number: 4702391 (relative sequence number)
Acknowledgement number: 563 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6744
Checksum: 0xc94b (correct)
Hypertext Transfer Protocol
Data (1360 bytes)

0000 f3 1e aa 78 4e d4 ee 80 c1 fe cd 19 90 58 b7 95 ...xN........X..
0010 5c b4 01 52 66 08 e9 9f 4f 58 f7 f8 97 37 4c c6 \..Rf...OX...7L.
0020 67 da b3 6a b6 f0 59 3e 5f b1 3c b6 80 d8 68 09 g..j..Y>_.<...h.
0030 fb a3 5d 58 fa 23 0c 6c ee e3 95 71 52 12 d4 d0 ..]X.#.l...qR...
0040 f4 f0 9a f7 72 ee 35 d8 81 a8 c3 ce af 7d 3c e5 ....r.5......}<.
0050 5b 3a ec 11 61 ed 79 ed cc 00 45 83 61 98 c5 d1 [:..a.y...E.a...
0060 3d 30 99 e8 11 00 58 cf bb 32 e7 c4 29 c0 0a 0b =0....X..2..)...
0070 f4 d7 9c b2 b2 7b eb 4a 08 51 6c 35 ab aa 21 be .....{.J.Ql5..!.
0080 87 ed 4d 62 89 81 99 a7 28 14 74 4a 24 40 15 d6 ..Mb....(.tJ$@..
0090 da de e1 69 22 eb 4f e9 97 b2 83 6e 70 87 84 64 ...i".O....np..d
00a0 89 1c 1d 81 d3 04 87 c5 4d 5f 78 26 df 36 b7 cc ........M_x&.6..
00b0 8a 38 35 3b 5a dc 51 02 74 f3 ef 5b f7 12 c7 06 .85;Z.Q.t..[....
00c0 43 6c dc a6 7a 1b 04 fe 1d 74 21 d2 4b d9 aa db Cl..z....t!.K...
00d0 3b e2 4d 68 38 b5 a0 61 59 17 ed 82 a0 70 f2 31 ;.Mh8..aY....p.1
00e0 d7 a1 10 e5 40 b8 2e 0a be ac d6 8e 25 ed 6b 8b ....@.......%.k.
00f0 d0 fc b3 6d 21 ce af 3f b2 1c 90 80 9c c8 83 b3 ...m!..?........
0100 cf 10 2b 0d c2 3b 69 2c c5 86 d1 d2 77 0c 3b ff ..+..;i,....w.;.
0110 39 6f d7 d5 25 66 36 30 07 27 53 5e a3 37 a9 9f 9o..%f60.'S^.7..
0120 52 5b 71 c1 30 dc d3 da 87 4d e3 6e e0 45 cc cb R[q.0....M.n.E..
0130 29 22 fd 13 35 e7 f1 74 7f 24 31 6c 23 03 ae a4 )"..5..t.$1l#...
0140 c5 1e 22 8e dd b5 75 7d a9 3e 71 a0 75 ce 21 dc .."...u}.>q.u.!.
0150 78 19 ec 74 bb 6d b6 f3 88 33 e7 4f 01 ef e7 9e x..t.m...3.O....
0160 fe f1 1c 61 4d 59 ed 0b ef 31 ca ca f8 ce 9f 55 ...aMY...1.....U
0170 c9 ae 49 ca 87 17 13 7f a1 fd 56 eb 72 94 a9 2e ..I.......V.r...
0180 4f e3 8f 23 6c ef d0 97 83 7b df 0a fc 5e 82 63 O..#l....{...^.c
0190 b7 3e ce 07 f3 c6 1d a0 f2 25 94 96 2f 39 bb 4d .>.......%../9.M
01a0 c1 d8 00 5f da 9a e8 e5 51 60 d7 fe 3b 9a eb 28 ..._....Q`..;..(
01b0 ee 6f 83 47 d0 26 93 0f c5 3a a0 c6 f2 e9 68 7c .o.G.&...:....h|
01c0 9e 28 07 9a aa f0 92 75 f8 47 1c 49 b8 96 59 41 .(.....u.G.I..YA
01d0 9d 85 49 a6 22 48 57 9b 3d 85 88 d5 8a 89 5e 1a ..I."HW.=.....^.
01e0 59 2a 2e 14 99 f6 e2 88 2f 65 86 e9 94 2b 86 e7 Y*....../e...+..
01f0 7f 50 38 95 1a 55 4d 15 01 4c 26 c6 5c 78 cd 70 .P8..UM..L&.\x.p
0200 d2 65 7d 33 65 fb 3c 1e 97 21 a9 b4 fb 8b f6 d2 .e}3e.<..!......
0210 89 d8 67 00 bf 54 e3 c8 a8 cc 09 7d b5 23 4f 1f ..g..T.....}.#O.
0220 d4 00 07 83 08 c7 e4 cd 2b 5d 19 a7 0b 33 62 83 ........+]...3b.
0230 dc a9 6e 4d 08 3c 8b 3b 84 0e 9e 6b 66 56 a5 a7 ..nM.<.;...kfV..
0240 95 fe 0e 01 a9 e7 95 01 0c 3f 7b 6e 7b c3 07 ef .........?{n{...
0250 99 aa 38 2f d4 c9 fa 6d 04 50 46 a6 e0 e9 69 45 ..8/...m.PF...iE
0260 1f 34 67 36 19 35 e3 95 24 2e 9d 1b 26 4d 09 bd .4g6.5..$...&M..
0270 55 99 3c f5 03 57 38 68 82 ed 78 9c ee 1c 48 d7 U.<..W8h..x...H.
0280 65 eb bb 1d 55 b0 fb ca ce ca 05 6f a0 b7 8f 6b e...U......o...k
0290 41 82 33 eb 52 be b1 19 b6 7a e5 bc a5 3c 50 61 A.3.R....z...<Pa
02a0 07 fc ab da 1b 38 bc cf 66 9a d4 34 0c 97 64 bd .....8..f..4..d.
02b0 66 e8 92 e2 d1 87 9e a5 f3 04 da c1 63 06 62 95 f...........c.b.
02c0 ee 13 40 f9 44 97 68 13 e4 59 8f 8e f9 78 19 96 ..@.D.h..Y...x..
02d0 72 e5 b1 1b be 27 fe b1 4d d7 d9 65 41 6f 73 72 r....'..M..eAosr
02e0 58 5e 73 65 2e 28 0f 4c 10 e3 02 e2 04 c5 73 bd X^se.(.L......s.
02f0 ee db 82 1f 9a 9a 2b b8 29 21 e1 75 f4 df fb 4a ......+.)!.u...J
0300 6c 12 9a b6 9f 55 8a 4e 2a e1 53 f3 8a 5d ce 41 l....U.N*.S..].A
0310 b7 7d e7 83 08 9e c2 0f e5 fd 9f 58 fa ba 8c b1 .}.........X....
0320 3f 72 74 1f 76 98 a6 71 08 6f 5d 9d 98 2c 49 8f ?rt.v..q.o]..,I.
0330 72 ce ca bf e4 be 93 11 f8 0b bc db 44 1b 09 7e r...........D..~
0340 cc 97 be 2f c3 ed f9 ef 1f 27 35 86 5a 25 79 61 .../.....'5.Z%ya
0350 e1 fd 02 61 ab b5 d7 f0 c7 e2 be 96 60 40 ee 8a ...a........`@..
0360 26 f7 d3 bd e2 ab de dc 1d de f9 6a 51 0a 53 01 &..........jQ.S.
0370 20 2a 5f 73 c6 c7 4d db 79 30 0f 68 33 65 1f 50 *_s..M.y0.h3e.P
0380 cd 6f 68 27 92 76 3e b1 4b ab 24 c1 30 2a 41 c5 .oh'.v>.K.$.0*A.
0390 7d 2a 6a 72 6d 02 d6 71 a5 06 a4 f9 dc 62 5a 45 }*jrm..q.....bZE
03a0 8f c4 f3 75 19 a8 fc 4d eb 3c 3b 6e d7 69 d9 b9 ...u...M.<;n.i..
03b0 09 9a a7 44 0f 17 42 ad 40 75 6b d3 8c 19 05 d0 ...D..B.@uk.....
03c0 6e ec 44 92 b1 75 fc f9 bf 24 19 a4 05 94 20 10 n.D..u...$.... .
03d0 8d 0a 25 f3 fc 72 6c e5 91 3f 70 da 28 62 e3 6d ..%..rl..?p.(b.m
03e0 05 64 73 29 b2 b0 99 df 13 02 81 b3 ed eb c4 18 .ds)............
03f0 49 e5 51 7b 3f d0 a3 b9 24 c1 9b bc 15 40 62 04 I.Q{?...$....@b.
0400 c9 ce b4 ce 0f ff de d0 fa 56 03 d7 ee b2 8a 68 .........V.....h
0410 ff e7 19 c1 72 65 5b 71 22 19 cb 26 03 3c 37 8a ....re[q"..&.<7.
0420 40 6e 54 e9 0a d2 82 12 c2 ec 70 7e bb fa cd 3f @nT.......p~...?
0430 21 7c 43 93 02 66 a9 a1 70 8a 7c 9d 86 fa c4 57 !|C..f..p.|....W
0440 9f 95 25 08 0d 0b 01 58 f7 f6 70 63 4c eb 86 03 ..%....X..pcL...
0450 2e 23 c9 ba 4f 99 c7 a4 98 cc c2 0d 3b ff dc 4e .#..O.......;..N
0460 ba 8a 7e 59 61 a9 14 39 17 b1 72 33 6a cd 7d 9c ..~Ya..9..r3j.}.
0470 29 7c 50 1a 09 b2 46 49 cb 23 ad 82 28 be c9 a5 )|P...FI.#..(...
0480 3d 67 31 76 b4 3d cf 75 83 33 6a 3a 6e b1 2c c6 =g1v.=.u.3j:n.,.
0490 31 0c a6 ea c4 f2 60 25 e5 ce ec 3f 7a 2b c5 06 1.....`%...?z+..
04a0 99 6d d3 84 2b 47 f0 2f 72 f9 aa f6 68 4b 8c 9d .m..+G./r...hK..
04b0 52 1b 1e 88 33 ad f1 6a 57 3b ee c0 24 af 2d 98 R...3..jW;..$.-.
04c0 18 4d 99 9a c6 e7 27 58 3b 21 f0 23 be b7 03 ca .M....'X;!.#....
04d0 a2 58 dc 75 ac 26 c8 4c d0 fd fe 9e 65 2c 52 92 .X.u.&.L....e,R.
04e0 04 47 01 d0 e6 3e 0d 19 b5 7a 3d e9 03 0a 7c 53 .G...>...z=...|S
04f0 44 26 89 92 b5 18 2c 60 2d 4a 21 82 e2 ea 50 5a D&....,`-J!...PZ
0500 0e 99 23 30 ca 6d 07 c7 61 7f d9 e7 77 f6 ca 3c ..#0.m..a...w..<
0510 06 14 d9 51 e0 b0 34 c0 e9 b3 ba 2b d9 a1 08 87 ...Q..4....+....
0520 30 62 3d da 27 5f 4e 48 ee b2 20 b4 cb c5 44 27 0b=.'_NH.. ...D'
0530 eb 21 2a ee cb 0e d2 ba a4 f4 b7 81 44 b8 e2 7e .!*.........D..~
0540 63 e1 65 6b e7 83 65 44 ab e8 30 28 c4 91 dd 0a c.ek..eD..0(....

No. Time Source Destination Protocol Info
5319 60.435877 10.0.0.100 192.150.18.29 TCP [TCP Dup ACK 5315#2] 1234 > http [ACK] Seq=563 Ack=4686071 Win=256960 [CHECKSUM INCORRECT] Len=0 SLE=2950856453 SRE=2950859173

Frame 5319 (66 bytes on wire, 66 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.225464000
Time delta from previous packet: 0.000014000 seconds
Time since reference or first frame: 60.435877000 seconds
Frame Number: 5319
Packet Length: 66 bytes
Capture Length: 66 bytes
Ethernet II, Src: 00:07:e9:08:d3:f5, Dst: 00:10:7b:f9:14:d4
Destination: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Source: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.0.100 (10.0.0.100), Dst Addr: 192.150.18.29 (192.150.18.29)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x226e (8814)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x0000 (incorrect, should be 0x3b3f)
Source: 10.0.0.100 (10.0.0.100)
Destination: 192.150.18.29 (192.150.18.29)
Transmission Control Protocol, Src Port: 1234 (1234), Dst Port: http (80), Seq: 563, Ack: 4686071, Len: 0
Source port: 1234 (1234)
Destination port: http (80)
Sequence number: 563 (relative sequence number)
Acknowledgement number: 4686071 (relative ack number)
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 256960
Checksum: 0xdd3d (incorrect, should be 0x5ebe)
Options: (12 bytes)
NOP
NOP
SACK:
left edge = 2950856453
right edge = 2950859173
SEQ/ACK analysis
TCP Analysis Flags
This is a TCP duplicate ack
Duplicate ACK #: 2
Duplicate to the ACK in frame: 5315



No. Time Source Destination Protocol Info
5395 61.003456 192.150.18.29 10.0.0.100 TCP http > 1234 [RST] Seq=4686071 Ack=149102004 Win=0 Len=0

Frame 5395 (60 bytes on wire, 60 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.793043000
Time delta from previous packet: 0.002832000 seconds
Time since reference or first frame: 61.003456000 seconds
Frame Number: 5395
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:10:7b:f9:14:d4, Dst: 00:07:e9:08:d3:f5
Destination: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Source: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src Addr: 192.150.18.29 (192.150.18.29), Dst Addr: 10.0.0.100 (10.0.0.100)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0xc38e (50062)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: TCP (0x06)
Header checksum: 0xe52a (correct)
Source: 192.150.18.29 (192.150.18.29)
Destination: 10.0.0.100 (10.0.0.100)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1234 (1234), Seq: 4686071, Ack: 149102004, Len: 0
Source port: http (80)
Destination port: 1234 (1234)
Sequence number: 4686071 (relative sequence number)
Header length: 20 bytes
Flags: 0x0004 (RST)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0xd3df (correct)

No. Time Source Destination Protocol Info
5396 61.005971 192.150.18.29 10.0.0.100 TCP http > 1234 [RST] Seq=4686071 Ack=149102004 Win=0 Len=0

Frame 5396 (60 bytes on wire, 60 bytes captured)
Arrival Time: Jul 12, 2004 18:59:34.795558000
Time delta from previous packet: 0.002515000 seconds
Time since reference or first frame: 61.005971000 seconds
Frame Number: 5396
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:10:7b:f9:14:d4, Dst: 00:07:e9:08:d3:f5
Destination: 00:07:e9:08:d3:f5 (Intel_08:d3:f5)
Source: 00:10:7b:f9:14:d4 (Cisco_f9:14:d4)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src Addr: 192.150.18.29 (192.150.18.29), Dst Addr: 10.0.0.100 (10.0.0.100)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0xc3c1 (50113)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: TCP (0x06)
Header checksum: 0xe4f7 (correct)
Source: 192.150.18.29 (192.150.18.29)
Destination: 10.0.0.100 (10.0.0.100)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1234 (1234), Seq: 4686071, Ack: 149102004, Len: 0
Source port: http (80)
Destination port: 1234 (1234)
Sequence number: 4686071 (relative sequence number)
Header length: 20 bytes
Flags: 0x0004 (RST)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0xd3df (correct)

No. Time Source Destination Protocol Info
5397 61.008491 192.150.18.29 10.0.0.100 TCP http > 1234 [RST] Seq=4686071 Ack=149102004 Win=0 Len=0

 

[bierhunter]

I was just reading on Cisco's site that FTP doesn't always work well with reflexive access-lists. It can cause session interruptions. I've not used reflexive access-lists before, so I can't speak from experience....just from what I read.

They recommend not using reflexive access-lists for FTP.

It's worth trying to see what happens. I'm really curious now.

BierHunter
CNE, MCSE, CCNP

 

[sames4239]

Intersting point. Two things though, this problem also happens on http transfers and also happens when the ACL's are removed. Would that change things?

Thanks,

Steve