CloudLabBox
Try the free demo

Packet analysis lab 7 of 12

TCP problems: retransmissions and zero windows with resets

Three complaints reach the network team on the same morning: backups crawl, the stock upload stalls and the price feed breaks off. You capture all three, read retransmissions, duplicate ACKs and SACK blocks, zero windows and probes, and a reset, decide which problem is the network's and which belong to applications, and fix the lossy circuit.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 07 - TCP problems - retransmissions and zero windows with resets

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
3 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

Three tickets reach Fellside Outdoor's network team on the same morning. "The backup download from the data centre crawls." "The stock upload to the database stalls for seconds at a time." "The supplier price feed breaks off half-way." All three use server SRV across the provider's circuit (WAN). Everybody blames the network. Your job: capture each one, say which problem really is the network's, fix that one, and hand the others to the right people with evidence.

DeviceInterfaceAddressRole
WSeth010.80.0.10/24your workstation; runs the three client programs
WANeth0 ↔ eth1bridge, no addressthe provider's circuit (a WAN emulator)
SRVeth010.80.0.20/24backups on HTTP 80, stock database on 9100, price feed on 9200

Your workstation, WS. Open WS's console (a remote desktop, root / eve), start Wireshark from Applications > Internet > Wireshark, and open a terminal. Write answers in /root/answers.txt (pluma /root/answers.txt &).

What you’ll practise

  • Find retransmissions, fast retransmissions, duplicate ACKs and out-of-order segments with Wireshark's TCP analysis
  • Read SACK blocks and work out the byte range a duplicate ACK says is missing
  • Recognise a receiver that can't keep up: zero windows, zero-window probes and window updates
  • Tell a reset from an orderly close and decide who sent it and why
  • Separate a network fault from application faults and prove the network fix

The tasks

  1. Recreate the circuit
  2. Capture the three complaints
  3. Retransmissions, duplicate ACKs and SACK
  4. A receiver that can't keep up
  5. A reset in the middle of a transfer
  6. Fix what belongs to the network

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of TCP problems - retransmissions and zero windows with resets3 nodes, 2 links. Every link is listed as text below the diagram.WSWANSRVeth0eth0eth1eth0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • WS eth0 to WAN eth0
  • WAN eth1 to SRV eth0
Nodes in TCP problems: retransmissions and zero windows with resets, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
SRVEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open 07 - TCP problems - retransmissions and zero windows with resets and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Packet analysis labs

All Packet analysis labs

Related labs in other courses

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.