Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a network that has 3 subnets,,, They are all routed using an IBM Proventia Firewall. The firewall is fairly straight forward and everything seems to be working fine.

However, if I try to contact a web server on from the page takes 5+ minutes to load, and often does not load all of the images completely.

If I contact that same web server from it loads instantly on any PC.

I can ping the web server from the 10.1.4.x network. I can port scan the server and see that traffic on 80 is free flowing from the 10.1.4.x network. The firewall is setup and allowing traffic.

So I took a wireshark capture of the traffic and filtered on ip.src == or ip.dst The capture is strange, there are many packets that seem to be missing from the HTTP transaction. Many warnings from wireshark regarding TCP Retransmissions. Almost every packet after the first 3-5 during initial contact are retransmitted. I captured a good HTTP transaction (to the same server) from my desktop and compared. It's almost like the firewall or something is dropping packets. This device has an IPS and AV system built in, I have tried disabling them both. (even both at the same time). The two subnets in question are wired locally no WAN links or VPNs. The subnet goes though a managed switch. Maybe the switch is dropping something?

enter image description here

share|improve this question
Two things: 1. Duplicate ACKs and TCP Retransmissions are a symptom of packet loss (usually due to network congestion). 2. TCP ACKed unseen segment (or TCP ACKed lost segment) can be a symptom of packet loss or it could be a result of the placement of wireshark. It means that wireshark saw an ACK for a segment it didn't see. It would seem to me that you probably have some packet loss between the two networks. Where are you running wireshark from? The best place to run it from would be on the source or destination host. – joeqwerty Dec 19 '12 at 15:44
I have tried testing the server connection with telnet while doing a capture with wireshark. Once again from my desktop (10.1.4.x) everything goes fine. From a PC on the 10.1.9.x network, I see traffic generated, then after a few minutes the connection is closed. See --> – Noobixide Dec 19 '12 at 16:11
I am running from the machine making the HTTP request. Also, I might make a trip to the data center to take a look at which switch the server is plugged into. That may help determine if there is some funky congestion problem. I know we have an outstanding congestion problem on a different segment of our network, I don't believe that this traffic would be flowing across that route. AFAIK the machine that I am running WS on is on the same switch in the same rack as the server. – Noobixide Dec 19 '12 at 16:45
up vote 1 down vote accepted

Problem resolved!

Turns out that another one of our Admins had setup the server demonstrating problems on a multihomed platform, and it had two default gateways. Wasn't the firewalls fault after all.


share|improve this answer
Glad you resolved this, please be sure to mark your answer as accepted when you're able. – jscott Jan 14 '13 at 15:14
Whoops, missed that part. Thanks! – Noobixide Jan 14 '13 at 18:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.