I have a network that has 3 subnets,,, They are all routed using an IBM Proventia Firewall. The firewall is fairly straight forward and everything seems to be working fine.

However, if I try to contact a web server on 10.1.9.xxx from 10.1.4.xxx the page takes 5+ minutes to load, and often does not load all of the images completely.

If I contact that same web server from 10.1.5.xxx it loads instantly on any PC.

I can ping the web server from the 10.1.4.x network. I can port scan the server and see that traffic on 80 is free flowing from the 10.1.4.x network. The firewall is setup and allowing traffic.

So I took a wireshark capture of the traffic and filtered on ip.src == 10.1.9.xxx or ip.dst 10.1.9.xxx. The capture is strange, there are many packets that seem to be missing from the HTTP transaction. Many warnings from wireshark regarding TCP Retransmissions. Almost every packet after the first 3-5 during initial contact are retransmitted. I captured a good HTTP transaction (to the same server) from my desktop and compared. It's almost like the firewall or something is dropping packets. This device has an IPS and AV system built in, I have tried disabling them both. (even both at the same time). The two subnets in question are wired locally no WAN links or VPNs. The 10.1.9.xxx subnet goes though a managed switch. Maybe the switch is dropping something?

enter image description here

  • Two things: 1. Duplicate ACKs and TCP Retransmissions are a symptom of packet loss (usually due to network congestion). 2. TCP ACKed unseen segment (or TCP ACKed lost segment) can be a symptom of packet loss or it could be a result of the placement of wireshark. It means that wireshark saw an ACK for a segment it didn't see. It would seem to me that you probably have some packet loss between the two networks. Where are you running wireshark from? The best place to run it from would be on the source or destination host. – joeqwerty Dec 19 '12 at 15:44
  • I have tried testing the server connection with telnet while doing a capture with wireshark. Once again from my desktop (10.1.4.x) everything goes fine. From a PC on the 10.1.9.x network, I see traffic generated, then after a few minutes the connection is closed. See --> i50.tinypic.com/33xeiq9.jpg – Noobixide Dec 19 '12 at 16:11
  • I am running from the machine making the HTTP request. Also, I might make a trip to the data center to take a look at which switch the server is plugged into. That may help determine if there is some funky congestion problem. I know we have an outstanding congestion problem on a different segment of our network, I don't believe that this traffic would be flowing across that route. AFAIK the machine that I am running WS on is on the same switch in the same rack as the server. – Noobixide Dec 19 '12 at 16:45

Problem resolved!

Turns out that another one of our Admins had setup the server demonstrating problems on a multihomed platform, and it had two default gateways. Wasn't the firewalls fault after all.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.