Wireshark-users: [Wireshark-users] Intermittant trouble getting to internet

From: "Sheahan, John" <John.Sheahan@xxxxxxxxxxxxx>
Date: Thu, 5 Nov 2009 20:08:17 -0500

The problem I am trying to troubleshoot is that some browsers intermittently have super slow access to the Internet through the proxy. When someone types in a URL, the browser just stalls out and then finally renders the page.

 

I have a trace file that shows the .64 address initiating to the proxy server .201 address on port 8080.

The .64 address does an HTTP get with their browser to yahoo.com and after that, the trace shows that .201 sends dozens of “TCP segments of a reassembled PDU” , all of which are ACKed by .64…but the odd thing is, none of this data is HTTP, all the packets are very large (1460 bytes) and all are received within the same second.

 

Finally, .201 sends an HTTP packet that shows the actual yahoo.com web page also within the same second but yet the client (.64) complains they never see the page.

 

Does this flow of data look normal to anyone?

 

If so, can you please give me any suggestions as to why the client is not seeing data?

(This happens with both IE and Firefox so it’s not a browser problem).

 

My thought is that something is wrong with the workstation other than the browser….perhaps spyware?

 

Thanks

 

John

Attachment: internet.pcap
Description: internet.pcap