Wireshark-users: Re: [Wireshark-users] [TCP Previous segemnt lost] Ignored Unknown record

From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 28 May 2008 08:24:14 +0200
On Tue, May 27, 2008 at 04:22:16PM -0700, jacob c wrote:
>    
>   We have a device that talks to a server through a load balancer. 
> The load balancer is a full proxy. When this intermittent problem 
> happens, the only difference I see between a good trace and a "bad" 
> trace/transaction is multiple FIN packets sent from the load 
> balancer before the transaction is complete. These are not being 
> forward form the webserver on the backend.  In this example, these 
> packets are 257 - 263. Any insight as to what is causing them would 
> be helpful. 

It looks like your load balancer has a session timeout on the client
side. What kind of load balancer do you use? Have a look at all the
settings, especially to any tcp settings.

> I have attached the trace in text format.

Next time, please provide a trace in binary format, they are usually
about the same size as the text format, but give a whole lot more
information. And it makes helping you a lot easier, as we can use
our favorite tool to read it :-)

Cheers,
    Sake