RE: Very Odd problem,server obssesed with client

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Kristin Thomas [MSFT] (kthomas_at_online.microsoft.com)
Date: 03/15/04 

Date: Mon, 15 Mar 2004 19:36:36 GMT

The exact port is going to be the clue of what might the machine be trying
to contact or do. Please respond with the source and destination ports of
the SYN packet, the OS of Admin3, whether it is a member server or Domain
Controller and what software the two machines have in common.

Thanks.

Best Regards,

Kristin Thomas, MCSE, MCP
Microsoft Enterprise Network Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| From: "Adysthemic" <asifidsay@imprivate.com>
| Newsgroups: microsoft.public.windows.server.networking
| Subject: Very Odd problem,server obssesed with client
| Date: Sat, 13 Mar 2004 11:47:27 -0800

|
| Group,
| After a year and one half of thinking about this Citrix server problem
| slowdown almost everday,I've discovered a breakthrough.I d/l ed this
little
| proggie a very long time ago,and only decided to play w/it this morning.It
| is called tcpView.Don't know why I tried it.I already had a big ol
powerful
| packet sniffer to look at.
| But honestly,although I understood how to use the sniffer on a basic
| level,it did not
| present things in the visual way I needed.
|
| With tcpv running,I opened a prog on the Citrix server.After 90 seconds
the
| prog opened.Watching the tcpv program,I saw that microsoft-ds sent a SYN
| packet to one specific computer,Admin3, on the network.
|
| The metaframe server is expecting that one box to ACK back,but it does
| not,if it is not on line,so any program that you try to open will wait for
| that ACK response,that does not come.It will wait until the ACK
| times out, then the program will open.
|
| This does not seem to be program specific.As a standard I test open event
| viewer.But anything from ms office, to my packet sniffer to whatever ,will
| cause the Citrix server to send a SYN packet to Admin3,and hang opening
| untill the expected
| ACK response times out,unless Admin3 is online!!???Any computergods out
| there have even a remote suggestion why this is occuring?
|
| This behaviour of the Admin3 response illustrated why I never had a
problem
| on Tuesdays.Sheesh Tuesday was a day I had Admin3 left on overnight for a
| backup to CDR,so the Citrix server always worked fine on
| Tues.Mornings as it was available to quickly ACK the SYN packet.This was
| what was causing a semi patterned appearance of the symptom.
| If Admin3 was online,the slowdown on the Citrix server, opening any
program,
| does not occur.
| So why is the Citrix server "obsessed" with sending a SYN packet to
| Admin3,whether or not Admin3 is online ,expecting an ACK,before it "lets"
| any program open??!!Oh BTW,this seems to all be based on microsoft-ds and
ms
| netbios ssn.The SYN originates on some port in the 4000 range,I forget at
| the moment.I think the ACK is expected
| from 445, having something to do with the Server Message Block [SMB]
| according to the Packet Sniffer,but I ain't too swift in my
interpretations
| with that packetsniffer tool yet.Please,please can anyone gimme a clue
about
| all this?I'm self taught and cannot find anything after 9hrs of hunting
| today.This has been my bane for a very long time,I think of it
everyday,tnx
| Adysthemic
|
|
|

Relevant Pages

  • Very Odd problem,server obssesed with client
    ... After a year and one half of thinking about this Citrix server problem ... prog opened.Watching the tcpv program,I saw that microsoft-ds sent a SYN ... packet to one specific computer,Admin3, on the network. ... The metaframe server is expecting that one box to ACK back,but it does ...
    (microsoft.public.windows.server.networking)
  • Re: Socket weirdness
    ... Anyway, if the application on one device does Shutdownthen if a packet containing data is received from the peer on that connection, then that is an not a valid packet and a packet with the RST bit set is sent clearing down the connection. ... In TCP there is simply *one* type of packet, this is unlike HDLC, which carries data in 'I' frames, has ACK frames which it calls 'RR', and lots more. ... And receiving a segment containing data is not valid where the local application has done shutdown). ...
    (microsoft.public.dotnet.framework)
  • Re: Interesting TCP behaviour with large sends/small buffers
    ... The server, upon connection, sends a configurable number of bytes to ... I set the client's receive buffer size to 1MBps, ... packet before sending the next packet. ... ACK, according to the delayed ACK algorithm - 50KB bytes means 34 MSS- ...
    (microsoft.public.win32.programmer.networks)
  • Re: Interesting TCP behaviour with large sends/small buffers
    ... TCP converter I've been working on, in which data arrives at specific ... I set the client's receive buffer size to 1MBps, ... packet before sending the next packet. ... ACK, according to the delayed ACK algorithm - 50KB bytes means 34 MSS- ...
    (microsoft.public.win32.programmer.networks)
  • Re: Interesting TCP behaviour with large sends/small buffers
    ... The server, upon connection, sends a configurable number of bytes to ... I set the client's receive buffer size to 1MBps, ... packet before sending the next packet. ... ACK, according to the delayed ACK algorithm - 50KB bytes means 34 MSS- ...
    (microsoft.public.win32.programmer.networks)