topic Re: Retransmission of packets on the gateway pcap but not on client pcap in General Topics

Retransmission of packets on the gateway pcap but not on client pcap

ashish_verma — Thu, 06 Jun 2019 16:32:54 GMT

Hello guys, This is a strange issue we are facing in which the client is able to access the server on port 80 but the resources hosted on the server works sometimes and does not work sometime. In the tcpdump pcap file catures on security gateway I see many retransmissions are there but on pcap file of client machine I do not see retransmissions.

The client is directly connected to the checkpoint direwall and Ipsec tunnel has been build netween the checkpoint and ASA firewall and behind ASA firewall the server is hosted.

Anyone faced this kind of issue? Could this be related to checkpoint or tunnel?

Thanks in advance!!

Re: Retransmission of packets on the gateway pcap but not on client pcap

PhoneBoy — Thu, 06 Jun 2019 19:10:11 GMT

Assuming you mean "directly connected" in a Layer 3 sense (i.e. same subnet).
Unless one end of the cable is the Check Point device and the other end is the server, there is something "in between." 😉
Reminds me of a problem I ran into when I was a TAC engineer years ago that we ultimately determined was in the switch configuration.
Not saying that's the case here, but you definitely need to rule that out.

Re: Retransmission of packets on the gateway pcap but not on client pcap

Maarten_Sjouw — Thu, 06 Jun 2019 22:00:31 GMT

To see if the problem is tunnel related, set the MTU of the PC interface to 1400 and test again, or use TCPoptimizer to test the max MTU and use that to set it (Freeware).
If that resolves your problem, look at mss clamping.

Re: Retransmission of packets on the gateway pcap but not on client pcap

Keval_Dhebar — Wed, 27 Sep 2023 14:33:55 GMT

@PhoneBoy we have one VLAN migrated on firewall and it can't make https connection with WLC (WLC is not on firewall).

FW logs from PC to WLC IP show bypass and accept
Wireshark shows TCP Spurious Retransmission from source IP to the WLC IP
It also shows it using TLSv1 and not TLS v1.1 or v1.2
All other wireshark captures from valid connections show TLSv1.2

Please suggest if any input to fix the issue.

Re: Retransmission of packets on the gateway pcap but not on client pcap

PhoneBoy — Thu, 28 Sep 2023 19:06:29 GMT

Please create a new thread with the details of your situation.
This will include all versions/JHF in use, a network diagram CLEARLY showing source/destination for the traffic as well as any gateways involved, packet captures (with details where/how they were taken), and any other evidence you can provide.