Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a virtualized Windows 2003 server that hosts one of my pieces of server software. The problem is that the port listener of this server doesn't get the client traffic sometimes. With Wireshark I can see the packet hit the NIC (vmxnet3, formerly Intel PRO 1000MT -- both exhibit this behavior) but it is never passed on past this:

  • Client -> NIC = this link is fine and reliable
  • NIC -> Server that's listening = unreliable, dropped or incorrectly routed packets?

I am deducing this packet is dropped, but I don't know how to trace this any further than with a Wireshark capture. I need to know what happens at the tcp stack level after this.

How can I further debug this to see what happens to the packet after it hits the NIC?

share|improve this question
You could give MS Network Monitor a shot - microsoft.com/download/en/details.aspx?id=4865. I have never used it, but maybe it has more visibility into packets at the OS level since it is made by MS? –  August Apr 20 '12 at 18:32
so it actually works sometimes? –  tony roth Apr 20 '12 at 18:34
@tonyroth Yes. The very odd part is that it's not just that it randomly fails to send packets from the NIC to the socket listener. Once it fails once, no more of that client's packets will ever make it from the NIC to the socket listener software. The only way to rectify it at this point is for the client to create a totally new socket and start over. –  kmarks2 Apr 20 '12 at 18:54
I'd create a customer listener and run it to see whats happening. –  tony roth Apr 20 '12 at 19:21
are there any application layer filters as in firewall on applications.. Also does your normal app write data to files? –  tony roth Apr 21 '12 at 0:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.