Hi everyone,
I am performing a file transfer using some off the shelf COTS TCP libraries in a C# program. During testing I transferred a 5Mb randomly generated file. The transmission path traverses a virtual NIC (TAP/TUN), then a hardware device serializes the data to push over a SATCOM Radio, On the receiver side and other hardware box de-serializes the data and the TCP traffic is output by another virtual NIC. Sometimes the file is transmitted correctly but sometimes the file is missing one contiguous chunk of data. It could be in the middle somewhere, and can be of varying size. The example I am using has a missing chuck of 16141 bytes. I have wireshark captures of both the sender and receiver The times are not synced exactly). I would love to know if this might indicate an issue with the underlying virtual NIC and radio hardware, or something that happening in the stack. Here are the notes I have taken regarding my observations of the issue and the wireshark captures. I hope to be able to post the captures on here once this gets posted.
Here are the two captures:
Sender Capture
Receiver Capture
Someone on another forum made the observations that:
Sender Trace: The client is running a windows platform (TTL=128) and so is the server at an CaeElect MAC address. The client port number is 1065, the offered windows size by the client is 16384, the 'MSS' option is 1460 (02:04:05:b4), followed by NOP,NOP,SACK
Receiver Trace: The client port number is 2025, it is 5 hops away (TTL=123), the advertized windowsize is 32768, MSS option is now in little endian: b4:05:04:02, sack is removed and 2 EOLs...
My Notes:
The file is contiguous until - 46 46 41 85 C4 ED 24 9D (Packet #1799 in wireshark sender Capture, Packet #6778 in Wireshark receive capture) - Note: This is a smaller packet than the norm. The packet data is
Then...
next bytes Should be:
3B 89 04 83 B6 34 9C 14 - Packet #1799 in wireshark sender Capture (01E0) - No Receive Packet with that data
but in the received file it is:
A3 D5 0F D9 10 B6 43 F3 - Packet #1814 in wireshark Sender Capture (0030) - Packet #6804 in Wireshark Receive Capture (0030)
This received string of bytes is found in the original file
1899228 - 1883087 = 16141 bytes of contiguous missing data
File size 5242880 byte (Sent) - 5226739 bytes (Received) = 16141 bytes, so this lines up too.
Is it looks like just his one big chunck is missing. Everything else, before and after, lines up.
I am performing a file transfer using some off the shelf COTS TCP libraries in a C# program. During testing I transferred a 5Mb randomly generated file. The transmission path traverses a virtual NIC (TAP/TUN), then a hardware device serializes the data to push over a SATCOM Radio, On the receiver side and other hardware box de-serializes the data and the TCP traffic is output by another virtual NIC. Sometimes the file is transmitted correctly but sometimes the file is missing one contiguous chunk of data. It could be in the middle somewhere, and can be of varying size. The example I am using has a missing chuck of 16141 bytes. I have wireshark captures of both the sender and receiver The times are not synced exactly). I would love to know if this might indicate an issue with the underlying virtual NIC and radio hardware, or something that happening in the stack. Here are the notes I have taken regarding my observations of the issue and the wireshark captures. I hope to be able to post the captures on here once this gets posted.
Here are the two captures:
Sender Capture
Receiver Capture
Someone on another forum made the observations that:
Sender Trace: The client is running a windows platform (TTL=128) and so is the server at an CaeElect MAC address. The client port number is 1065, the offered windows size by the client is 16384, the 'MSS' option is 1460 (02:04:05:b4), followed by NOP,NOP,SACK
Receiver Trace: The client port number is 2025, it is 5 hops away (TTL=123), the advertized windowsize is 32768, MSS option is now in little endian: b4:05:04:02, sack is removed and 2 EOLs...
My Notes:
The file is contiguous until - 46 46 41 85 C4 ED 24 9D (Packet #1799 in wireshark sender Capture, Packet #6778 in Wireshark receive capture) - Note: This is a smaller packet than the norm. The packet data is
Then...
next bytes Should be:
3B 89 04 83 B6 34 9C 14 - Packet #1799 in wireshark sender Capture (01E0) - No Receive Packet with that data
but in the received file it is:
A3 D5 0F D9 10 B6 43 F3 - Packet #1814 in wireshark Sender Capture (0030) - Packet #6804 in Wireshark Receive Capture (0030)
This received string of bytes is found in the original file
1899228 - 1883087 = 16141 bytes of contiguous missing data
File size 5242880 byte (Sent) - 5226739 bytes (Received) = 16141 bytes, so this lines up too.
Is it looks like just his one big chunck is missing. Everything else, before and after, lines up.
