The retransmission does get ACKed in frame 20. ~200ms later the request is repeated by hitting the retransmission-timeout (RTO). But there is no response to the request in frame 18. There are requests from the APP to the DB and the DB is responding quickly (1-25 milliseconds). Up until frame 18, everything looks fine. This means the capture was made on (or at least very near) to the sender of the SYN and the ACK.īy looking at the 3-way handshake, we also learned that the RTT between the application server (APP) and the database server (DB) is about 1 millisecond. Then there is an 18 microsecond delta between the SYN/ACK and the ACK. There is a delta of 981 microseconds between the SYN and the SYN/ACK. This can be checked by looking at the 3-way handshake. The packets were indeed captured on the application server (192.168.0.10). There is a bug in the SQL*Plus client that makes it send out a packet that the database server does not understand, so it does not respond to the request in packet 18 and 19. The URG flag in frame 21 is used by the SQL*Plus client to try to speed up the connection process.Į.

There is a mismatch in the configuration of the Ethernet interfaces on the two servers and the firewall.ĭ. The Database server did not receive packet 18 so the client sends a retransmission after a retransmission-timeout (RTO) of 200ms.Ĭ. The 'TCP Previous segment not captured' message in frame 20 means that one or more packets from the Database server were not written to the pcap file, even though the application server received them properly.ī.

Have a look at the packets and pick the correct answer ( click to download trace file).Ī. Pressing CTRL+C is also ignored and won't get the DBA back to the command prompt.”ĭuring the test, all packets to/from the Database server were captured on the application server. The connection seems to start OK, but then freezes. “A new application server has been installed in the DMZ and the DBA is using SQL*Plus to make a connection to the Database server in the internal network.

Wireshark rto