Re: Regarding TCP Previous Segment Lost

[Stuart Kendrick <skendric () fhcrc org>]

Hi Zach,

I have seen a TCP stack get confused about TCP Sequence numbers, 
cruising along fine for hours (long-lived connections) and then suddenly 
incrementing TCP ACK not by a few hundred bytes, as one would expect by 
the size of the TCP payload in the previous frame, but by ~1.2GB, in the 
example I'm reviewing.  The two sides of the TCP connection would get 
stuck for hours on this one frame, with the server (buggy TCP stack) 
eventually terminating the connection.  This went on for at least a year 
or so ... gradually increasing in frequency from once every week or two 
to multiple times per day.

We ended up calling the manufacturer of the TCP stack.  Turns out they 
had identified and fixed this bug a just few weeks earlier; we installed 
the patch, and TCP went back to performing reliable arithmetic.

So there's one scenario which would result in the behavior you're seeing 
-- I expect that there are many others.

hth,

--sk

On 3/20/2012 7:44 AM, Zachary J. Ziemba wrote:
> Hi,
>
> Can anyone offer a potential scenario that would explain why the 
> highlighted packets are occurring in a stream that they do not appear 
> to correspond to? I'm new to analyzing network traffic and can't 
> understand why the sequence number would transition in such a way 
> mid-connection. Wireshark lists these packets as Previous Segment 
> Lost/Retransmission but they appear to be unrelated to the connection.
>
> Thanks in advance,
>
> Zach
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe