[Sake Blok <sake@xxxxxxxxxx>]

Hello,

It looks like you made the capture on the system with IP address 192.168.0.2 (as the ACK in frame 147 has a length that is smaller than the minimum ethernet length of 64 or 60 without FCS).

This endpoint does receive the ACK on the clienthello (frame 150) and it does receive the ServerHello (frame 184). However, it keeps resending the ClientHello with an ACK of 1, as if the ACK and SeverHello were never received.

Looking into these two packets (frame 150 and 184), it can be seen that the IP checksum is off by 1. As the IP checksum needs to be recalculated when there is NAT, the natting router between 192.168.0.2 and the Internet might have a bug in the firmware. Could you check whether there is a newer version of the firmware available?

Cheers,

Sake

www.SYN-bit.nl

On 25 apr 2015, at 21:31, Jf Sénéchal wrote:

hello

I encounter a trouble with my boss at home with his client voo provider

he can not read emails professionals via a client such as Thunderbird

the connection is in imap ssl port 993

It works everywhere except at  his home

So obviously the basic tests have been done with other tests ordis the other mail client, other accounts on the same server etc ...

According to my analysis it seems that is level with the encryption it raises concerns

Contact Customer much mail server, but it seems that there is a return worries

Here is some info, customer voo in which everything works and in person to which this poses problems

Wireshark chez le client ok

http://afmlibre.be/voo/wireshark-ok.jpg

Wireshark chez le client ko

http://afmlibre.be/voo/wireshark-ko.jpg

Wireshark en detail

http://afmlibre.be/voo/wireshark-detail.jpg

complete capture wireshark

http://afmlibre.be/voo/cap2.pcapng

tracert

http://afmlibre.be/voo/tracer2t.jpg

ssldump on mail server  

http://afmlibre.be/voo/ssldump.jpg

Can you help me ?

Merci

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe