I am facing an issue that some packets sent out to internet from inside network were missing. The pattern we are using is like:
Client A ←→ Switch A ← Router A:NAT ← .. Network .. → Router B:NAT → Switch B ←→ Server B
I want to do below two steps to track the issue:
- Capture the packets which are from Client A on Router B.
- Check the translation table of Router B.
Are both actions possible?
- Client A is running on Windows XP
- Server B is running on Linux (Fedora exactly).
- The Router B use static port and address translation table which means incoming packets
to specific port will be forwarded to Server B.
- Both Router A and Router B are TPLink WR340+ products.
- Both Router A and Router B have Full-cone NAT.
- Switch A is DLink DES-1024R and Switch B is DLink DES-1016D.
The reason why I want to perform the two actions is that we found packets were sent out of the network interface of ClientA, but due to unknown reason the TCP kernel of ClientA machine never receives any ACK packet from the other endpoint, thus it enters data transmission until timeout. And from the server side, also using Tool WireShark we found the network interface of Server B machine never receives the packet sent from client A. I guess the packets were dropped by Router B, so I wonder if it is possible to capture packets at Router B.
Actually the issue only happened when we have two clients, say they are Client A and Client C. The Client A and Client C don't communicate with each other directly, but communicate with Server B instead.
Problem happened when we unplug the network cable of Client A machine and on another machine log in Client A in about 30 seconds, client A on the new machine will start TCP communication with server B, the first many commands are OK, but after that server can't receive any command from Client A anymore.