1

In a few minutes I have received about 7 millions(!) FIN-ACK packets from IP address that belongs to Google 74.125.133.188 what totally blocked network traffic on my desktop(!) machine.

Other machines on the same network did not experience any problems with network connectivity, so I take that the issue is limited to one particular machine.

It happened a few times already and stops when I reboot the switch.

Given the intensity of the traffic it does not look like application problem (Chrome, Google Drive), so what information would I need to gather to find out what causes it?

7885693 432.083148000   74.125.133.188  172.16.0.10 [TCP Retransmission] 5228→34565 [FIN, ACK] Seq=1 Ack=1 Win=358 Len=0 TSval=30554106 TSecr=62470 66  TCP

enter image description here enter image description here

UPDATE

Wireshark dump of first 300 packets

UPDATE 2

arp -a output

Interface: 172.16.0.2 --- 0xb
Internet Address Physical Address Type
172.16.0.1 9c-d3-6d-db-0d-1b dynamic
172.16.0.255 ff-ff-ff-ff-ff-ff static
172.16.2.1 4c-60-de-24-31-6b dynamic
224.0.0.2 01-00-5e-00-00-02 static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
255.255.255.255 ff-ff-ff-ff-ff-ff static 

Interface: 169.254.201.111 --- 0x1d
Internet Address Physical Address Type
169.254.255.255 ff-ff-ff-ff-ff-ff static
224.0.0.2 01-00-5e-00-00-02 static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
255.255.255.255 ff-ff-ff-ff-ff-ff static
3
  • 1
    Do you have some sort of program monitoring what is on your local machine and connecting out, I would hazard a guess something has notified the server of your machine (IP) address and then the server is sending retransmissions to you, if it's not happening to other machines on your immediate network then it's less likely to be a probing outside-origin action. Check for any error logs or traffic analysis on your router.
    – Martin
    Jul 21 '15 at 20:22
  • Could it be that you have switches connected in a loop?
    – kasperd
    Jul 24 '15 at 10:11
  • @kasperd definitely no loops. All wired connections
    – matcheek
    Jul 24 '15 at 11:10
2

For the benefit of those who will encounter this problem in the future I am posting the solution. After applying cross-testing I ruled out particular operating system, physical machine to end up on a broken port on the network switch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.