Wireshark · Ethereal-users: Re: [Ethereal-users] Five HTTP 200 responses for one single Request

Ethereal-users: Re: [Ethereal-users] Five HTTP 200 responses for one single Request

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
Date: Sat, 5 Nov 2005 16:05:50 +0100
Hi,

The response frames are 1514 bytes long, so in their way to the client
the packets might be fragmented (and nor reassembled by the client) or
dropped by some intermediary (router or switch). Tunnels (GRE, IPSEC,
MPLS) are  places where this kind of problems happen.

Try pings with different sizes with the DF bit set (Don't Fragment)
and see when they start to fail.

A workarround would be to try to reduce the MTU of the interface of
the server so that response packets will fit the MTU of the narrowest
link without being fragmented.

L

On 11/5/05, Raj Sinha <raj.sinha@xxxxxxxxx> wrote:
> HI Luis.
> U are right. Any insight into what triggers that. We have another IP phone
> with a diiferent hardware platform that does not have the same symptom. Just
> this hardware type.
>
> Besides this diff, I am really looking to understand anything int the trace
> that will trigger 5 responses.
>
> Raj
>
>
> On 11/4/05, LEGO <luis.ontanon@xxxxxxxxx> wrote:
> >
> > I see 5 retransmissions of the *same* packet containing an HTTP
> > response, so, it is 5 packets containing an HTTP response.
> >
> > On 11/4/05, Raj Sinha <raj.sinha@xxxxxxxxx> wrote:
> > > Can some tell me why we are getting five HTTP responses for a single
> HTTP
> > > request.
> > >
> > > What are we violating in the TCP IP ack that warrants a re transmission
> five
> > > times.
> > >
> > > I would appreciate any help. Attached is the Etehereal trace. If you
> apply
> > > this filer you can see whats happening
> > > (ip.addr eq 10.60.32.106 and ip.addr eq 10.160.117.16) and (tcp.port eq
> 80
> > > and tcp.port eq 1032)
> > >
> > >
> > > Frames 50, 173, 1089, 2707 gets re sent.
> > > Raj
> > >
> > > or see below
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >      23 2.493586    10.160.117.16         10.60.32.106           HTTP
>  GET
> > > /avaya/test/notworking.wml HTTP/1.1
> > >
> > > Frame 23 (281 bytes on wire, 281 bytes captured)
> > > Ethernet II, Src: 00:04:0d:29:54:60, Dst: 00:00:0c:07:ac:01
> > > Internet Protocol, Src Addr: 10.160.117.16 ( 10.160.117.16), Dst Addr:
> > > 10.60.32.106 (10.60.32.106)
> > > Transmission Control Protocol, Src Port: 1032 (1032), Dst Port: http
> (80),
> > > Seq: 0, Ack: 0, Len: 227
> > >     Source port: 1032 (1032)
> > >     Destination port: http (80)
> > >     Sequence number: 0    (relative sequence number)
> > >     Next sequence number: 227    (relative sequence number)
> > >     Acknowledgement number: 0    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0018 (PSH, ACK)
> > >     Window size: 8192
> > >     Checksum: 0xa123 (correct)
> > > Hypertext Transfer Protocol
> > >     GET /avaya/test/notworking.wml HTTP/1.1\r\n
> > >     Accept: image/vnd.wap.wbmp,text/vnd.wap.wml,*/*;q=
> > > 0.3\r\n
> > >     Accept-Charset: UTF-8,ISO-8859-1,US-ASCII\r\n
> > >     TE: trailers\r\n
> > >     Host: teleweb\r\n
> > >     User-Agent: AVAYA/IGEN/v2.2+(4620a)/0.0\r\n
> > >     Connection: TE\r\n
> > >     \r\n
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >      24 2.493586    10.60.32.106          10.160.117.16         HTTP
> > > HTTP/1.1 200 OK
> > >
> > > Frame 24 (1514 bytes on wire, 1514 bytes captured)
> > > Ethernet II, Src: 00:09:12:1e:48:06, Dst: 00:04:0d:29:54:60
> > > Internet Protocol, Src Addr: 10.60.32.106 ( 10.60.32.106), Dst Addr:
> > > 10.160.117.16 (10.160.117.16)
> > > Transmission Control Protocol, Src Port: http (80), Dst Port: 1032
> (1032),
> > > Seq: 0, Ack: 227, Len: 1460
> > >     Source port: http (80)
> > >     Destination port: 1032 (1032)
> > >     Sequence number: 0    (relative sequence number)
> > >     Next sequence number: 1460    (relative sequence number)
> > >     Acknowledgement number: 227    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0010 (ACK)
> > >     Window size: 8090
> > >     Checksum: 0x68a0 (correct)
> > >     SEQ/ACK analysis
> > > Hypertext Transfer Protocol
> > >     HTTP/1.1 200 OK\r\n
> > >     Server: Microsoft-IIS/4.0\r\n
> > >     Date: Mon, 17 Oct 2005 15:24:42 GMT\r\n
> > >     Content-Type: text/vnd.wap.wml\r\n
> > >     Accept-Ranges: bytes\r\n
> > >     Last-Modified: Fri, 22 Jul 2005 09:28:43 GMT\r\n
> > >     ETag: "5687e4c09f8ec51:140f"\r\n
> > >     Content-Length: 2527\r\n
> > >     \r\n
> > > eXtensible Markup Language
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >      25 2.493586    10.60.32.106          10.160.117.16         HTTP
> > > Continuation or non-HTTP traffic
> > >
> > > Frame 25 (1356 bytes on wire, 1356 bytes captured)
> > > Ethernet II, Src: 00:09:12:1e:48:06, Dst: 00:04:0d:29:54:60
> > > Internet Protocol, Src Addr: 10.60.32.106 ( 10.60.32.106), Dst Addr:
> > > 10.160.117.16 (10.160.117.16)
> > > Transmission Control Protocol, Src Port: http (80), Dst Port: 1032
> (1032),
> > > Seq: 1460, Ack: 227, Len: 1302
> > >     Source port: http (80)
> > >     Destination port: 1032 (1032)
> > >     Sequence number: 1460    (relative sequence number)
> > >     Next sequence number: 2762    (relative sequence number)
> > >     Acknowledgement number: 227    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0018 (PSH, ACK)
> > >     Window size: 8090
> > >     Checksum: 0x0624 (correct)
> > > Hypertext Transfer Protocol
> > >     Data (1302 bytes)
> > >
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >      26 2.503600    10.160.117.16         10.60.32.106           TCP
> > > 1032 > http [ACK] Seq=227 Ack=0 Win=8192 Len=0
> > >
> > > Frame 26 (56 bytes on wire, 56 bytes captured)
> > > Ethernet II, Src: 00:04:0d:29:54:60, Dst: 00:00:0c:07:ac:01
> > > Internet Protocol, Src Addr: 10.160.117.16 ( 10.160.117.16), Dst Addr:
> > > 10.60.32.106 (10.60.32.106)
> > > Transmission Control Protocol, Src Port: 1032 (1032), Dst Port: http
> (80),
> > > Seq: 227, Ack: 0, Len: 0
> > >     Source port: 1032 (1032)
> > >     Destination port: http (80)
> > >     Sequence number: 227    (relative sequence number)
> > >     Acknowledgement number: 0    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0010 (ACK)
> > >     Window size: 8192
> > >     Checksum: 0x9912 (correct)
> > >     SEQ/ACK analysis
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >      50 4.676725    10.60.32.106          10.160.117.16         HTTP
> > > HTTP/1.1 200 OK
> > >
> > > Frame 50 (1514 bytes on wire, 1514 bytes captured)
> > > Ethernet II, Src: 00:09:12:1e:48:06, Dst: 00:04:0d:29:54:60
> > > Internet Protocol, Src Addr: 10.60.32.106 ( 10.60.32.106), Dst Addr:
> > > 10.160.117.16 (10.160.117.16)
> > > Transmission Control Protocol, Src Port: http (80), Dst Port: 1032
> (1032),
> > > Seq: 0, Ack: 227, Len: 1460
> > >     Source port: http (80)
> > >     Destination port: 1032 (1032)
> > >     Sequence number: 0    (relative sequence number)
> > >     Next sequence number: 1460    (relative sequence number)
> > >     Acknowledgement number: 227    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0010 (ACK)
> > >     Window size: 8090
> > >     Checksum: 0x68a0 (correct)
> > >     SEQ/ACK analysis
> > > Hypertext Transfer Protocol
> > >     HTTP/1.1 200 OK\r\n
> > >     Server: Microsoft-IIS/4.0\r\n
> > >     Date: Mon, 17 Oct 2005 15:24:42 GMT\r\n
> > >     Content-Type: text/vnd.wap.wml\r\n
> > >     Accept-Ranges: bytes\r\n
> > >     Last-Modified: Fri, 22 Jul 2005 09:28:43 GMT\r\n
> > >     ETag: "5687e4c09f8ec51:140f"\r\n
> > >     Content-Length: 2527\r\n
> > >     \r\n
> > > eXtensible Markup Language
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >     173 9.053018    10.60.32.106          10.160.117.16         HTTP
> > > HTTP/1.1 200 OK
> > >
> > > Frame 173 (1514 bytes on wire, 1514 bytes captured)
> > > Ethernet II, Src: 00:09:12:1e:48:06, Dst: 00:04:0d:29:54:60
> > > Internet Protocol, Src Addr: 10.60.32.106 ( 10.60.32.106), Dst Addr:
> > > 10.160.117.16 (10.160.117.16)
> > > Transmission Control Protocol, Src Port: http (80), Dst Port: 1032
> (1032),
> > > Seq: 0, Ack: 227, Len: 1460
> > >     Source port: http (80)
> > >     Destination port: 1032 (1032)
> > >     Sequence number: 0    (relative sequence number)
> > >     Next sequence number: 1460    (relative sequence number)
> > >     Acknowledgement number: 227    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0010 (ACK)
> > >     Window size: 8090
> > >     Checksum: 0x68a0 (correct)
> > >     SEQ/ACK analysis
> > > Hypertext Transfer Protocol
> > >     HTTP/1.1 200 OK\r\n
> > >     Server: Microsoft-IIS/4.0\r\n
> > >     Date: Mon, 17 Oct 2005 15:24:42 GMT\r\n
> > >     Content-Type: text/vnd.wap.wml\r\n
> > >     Accept-Ranges: bytes\r\n
> > >     Last-Modified: Fri, 22 Jul 2005 09:28:43 GMT\r\n
> > >     ETag: "5687e4c09f8ec51:140f"\r\n
> > >     Content-Length: 2527\r\n
> > >     \r\n
> > > eXtensible Markup Language
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >    1089 17.805603   10.60.32.106          10.160.117.16         HTTP
> > > HTTP/1.1 200 OK
> > >
> > > Frame 1089 (1514 bytes on wire, 1514 bytes captured)
> > > Ethernet II, Src: 00:09:12:1e:48:06, Dst: 00:04:0d:29:54:60
> > > Internet Protocol, Src Addr: 10.60.32.106 ( 10.60.32.106), Dst Addr:
> > > 10.160.117.16 (10.160.117.16)
> > > Transmission Control Protocol, Src Port: http (80), Dst Port: 1032
> (1032),
> > > Seq: 0, Ack: 227, Len: 1460
> > >     Source port: http (80)
> > >     Destination port: 1032 (1032)
> > >     Sequence number: 0    (relative sequence number)
> > >     Next sequence number: 1460    (relative sequence number)
> > >     Acknowledgement number: 227    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0010 (ACK)
> > >     Window size: 8090
> > >     Checksum: 0x68a0 (correct)
> > >     SEQ/ACK analysis
> > > Hypertext Transfer Protocol
> > >     HTTP/1.1 200 OK\r\n
> > >     Server: Microsoft-IIS/4.0\r\n
> > >     Date: Mon, 17 Oct 2005 15:24:42 GMT\r\n
> > >     Content-Type: text/vnd.wap.wml\r\n
> > >     Accept-Ranges: bytes\r\n
> > >     Last-Modified: Fri, 22 Jul 2005 09:28:43 GMT\r\n
> > >     ETag: "5687e4c09f8ec51:140f"\r\n
> > >     Content-Length: 2527\r\n
> > >     \r\n
> > > eXtensible Markup Language
> > >
> > > No.     Time        Source                Destination
>         Protocol
> > > Info
> > >    2707 35.300760   10.60.32.106          10.160.117.16         HTTP
> > > HTTP/1.1 200 OK
> > >
> > > Frame 2707 (1514 bytes on wire, 1514 bytes captured)
> > > Ethernet II, Src: 00:09:12:1e:48:06, Dst: 00:04:0d:29:54:60
> > > Internet Protocol, Src Addr: 10.60.32.106 ( 10.60.32.106), Dst Addr:
> > > 10.160.117.16 (10.160.117.16)
> > > Transmission Control Protocol, Src Port: http (80), Dst Port: 1032
> (1032),
> > > Seq: 0, Ack: 227, Len: 1460
> > >     Source port: http (80)
> > >     Destination port: 1032 (1032)
> > >     Sequence number: 0    (relative sequence number)
> > >     Next sequence number: 1460    (relative sequence number)
> > >     Acknowledgement number: 227    (relative ack number)
> > >     Header length: 20 bytes
> > >     Flags: 0x0010 (ACK)
> > >     Window size: 8090
> > >     Checksum: 0x68a0 (correct)
> > >     SEQ/ACK analysis
> > > Hypertext Transfer Protocol
> > >     HTTP/1.1 200 OK\r\n
> > >     Server: Microsoft-IIS/4.0\r\n
> > >     Date: Mon, 17 Oct 2005 15:24:42 GMT\r\n
> > >     Content-Type: text/vnd.wap.wml\r\n
> > >     Accept-Ranges: bytes\r\n
> > >     Last-Modified: Fri, 22 Jul 2005 09:28:43 GMT\r\n
> > >     ETag: "5687e4c09f8ec51:140f"\r\n
> > >     Content-Length: 2527\r\n
> > >     \r\n
> > > eXtensible Markup Language
> > >
> > > _______________________________________________
> > > Ethereal-users mailing list
> > > Ethereal-users@xxxxxxxxxxxx
> > >
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> > >
> > >
> > >
> > >
> >
> >
> > --
> > This information is top security. When you have read it, destroy yourself.
> > -- Marshall McLuhan
> >
> > _______________________________________________
> > Ethereal-users mailing list
> > Ethereal-users@xxxxxxxxxxxx
> >
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> >
>
>
>
> --
> Raj Sinha
> raj.sinha@xxxxxxxxx
> 973 325 1410 (res)
> 973 220 8244 (cell)
> 732 852 2077 (work)
> 31 Oak Avenue
> West Orange, NJ 07052
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
>


--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan
References:
- [Ethereal-users] Five HTTP 200 responses for one single Request
  - From: Raj Sinha
- Re: [Ethereal-users] Five HTTP 200 responses for one single Request
  - From: LEGO
- Re: [Ethereal-users] Five HTTP 200 responses for one single Request
  - From: Raj Sinha
Prev by Date: Re: [Ethereal-users] Five HTTP 200 responses for one single Request
Next by Date: [Ethereal-users] Tektronix Analyzer Recording File Viewer-Setup
Previous by thread: Re: [Ethereal-users] Five HTTP 200 responses for one single Request
Next by thread: [Ethereal-users] Re: Five HTTP 200 responses for one single Request
Index(es):
- Date
- Thread