ASA-5512X Reassembly error, protocol TCP: New fragment overlaps old data (retransmission)

bliao · ‎03-10-2020

I have an issue access a public website and the site just wouldn't load. Could someone please point me to the right direction?

Running wireshark capture gives the following:

My pcap:

No. Time Source Destination Protocol Length Info
33 1.515414 170.48.10.149 172.16.0.44 TLSv1.2 1434 Server Hello
34 1.515541 170.48.10.149 172.16.0.44 TCP 1434 443 → 63884 [ACK] Seq=1369 Ack=518 Win=4657 Len=1368 TSval=3318738039 TSecr=2072913435 [TCP segment of a reassembled PDU]
35 1.515555 172.16.0.44 170.48.10.149 TCP 66 63884 → 443 [ACK] Seq=518 Ack=2737 Win=65535 Len=0 TSval=2072913515 TSecr=3318738039
36 1.515670 170.48.10.149 172.16.0.44 TCP 1434 443 → 63884 [PSH, ACK] Seq=2737 Ack=518 Win=4657 Len=1368 TSval=3318738039 TSecr=2072913435 [TCP segment of a reassembled PDU]
37 1.515682 172.16.0.44 170.48.10.149 TCP 66 63884 → 443 [ACK] Seq=518 Ack=4105 Win=65535 Len=0 TSval=2072913515 TSecr=3318738039
38 1.544629 172.16.0.24 172.16.0.255 UDP 63 58563 → 8083 Len=21
39 1.544657 172.16.0.24 172.16.0.255 UDP 63 58563 → 8083 Len=21
40 1.544663 172.16.0.24 172.16.0.255 UDP 63 58563 → 8083 Len=21
41 1.545055 fe80::1c62:e5b2:8327:c14a ff08::2 UDP 83 58565 → 8083 Len=21
42 1.545875 fe80::843:b0b:ea65:77e4 ff08::2 UDP 83 58566 → 8083 Len=21
43 1.593847 170.48.10.149 172.16.0.44 TLSv1.2 535 Certificate, Server Key Exchange, Server Hello Done
44 1.593940 172.16.0.44 170.48.10.149 TCP 66 63885 → 443 [ACK] Seq=518 Ack=4574 Win=65535 Len=0 TSval=2072913594 TSecr=3318738117
45 1.594334 170.48.10.149 172.16.0.44 TLSv1.2 535 Certificate, Server Key Exchange, Server Hello Done
46 1.594402 172.16.0.44 170.48.10.149 TCP 66 63884 → 443 [ACK] Seq=518 Ack=4574 Win=65535 Len=0 TSval=2072913594 TSecr=3318738117
47 1.605788 172.16.0.44 170.48.10.149 TLSv1.2 192 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
48 1.606806 172.16.0.44 170.48.10.149 TLSv1.2 192 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
49 1.607611 fe80::5cb5:c153:348a:216f ff02::1:2 DHCPv6 169 Solicit XID: 0x1a8f76 CID: 0001000124eca1b05065f3bdb4f8
50 1.684697 170.48.10.149 172.16.0.44 TCP 66 443 → 63885 [ACK] Seq=4574 Ack=644 Win=4783 Len=0 TSval=3318738208 TSecr=2072913605
51 1.684717 170.48.10.149 172.16.0.44 TLSv1.2 72 Change Cipher Spec
52 1.684762 172.16.0.44 170.48.10.149 TCP 66 63885 → 443 [ACK] Seq=644 Ack=4580 Win=65535 Len=0 TSval=2072913683 TSecr=3318738208
53 1.685095 170.48.10.149 172.16.0.44 TLSv1.2 111 Encrypted Handshake Message
54 1.685157 172.16.0.44 170.48.10.149 TCP 66 63885 → 443 [ACK] Seq=644 Ack=4625 Win=65535 Len=0 TSval=2072913683 TSecr=3318738209
55 1.685633 172.16.0.44 170.48.10.149 TCP 1434 63885 → 443 [ACK] Seq=644 Ack=4625 Win=65535 Len=1368 TSval=2072913683 TSecr=3318738209 [TCP segment of a reassembled PDU]
56 1.685658 172.16.0.44 170.48.10.149 TLSv1.2 127 Application Data
57 1.686094 170.48.10.149 172.16.0.44 TCP 66 443 → 63884 [ACK] Seq=4574 Ack=644 Win=4783 Len=0 TSval=3318738209 TSecr=2072913606
58 1.686765 170.48.10.149 172.16.0.44 TLSv1.2 72 Change Cipher Spec
59 1.686833 172.16.0.44 170.48.10.149 TCP 66 63884 → 443 [ACK] Seq=644 Ack=4580 Win=65535 Len=0 TSval=2072913684 TSecr=3318738210
60 1.687279 170.48.10.149 172.16.0.44 TLSv1.2 111 Encrypted Handshake Message
61 1.687338 172.16.0.44 170.48.10.149 TCP 66 63884 → 443 [ACK] Seq=644 Ack=4625 Win=65535 Len=0 TSval=2072913685 TSecr=3318738210
64 1.764710 170.48.10.149 172.16.0.44 TCP 66 443 → 63885 [ACK] Seq=4625 Ack=2073 Win=6212 Len=0 TSval=3318738288 TSecr=2072913683
65 1.765058 170.48.10.149 172.16.0.44 TLSv1.2 311 Application Data
66 1.765137 172.16.0.44 170.48.10.149 TCP 66 63885 → 443 [ACK] Seq=2073 Ack=4870 Win=65535 Len=0 TSval=2072913762 TSecr=3318738288
67 1.765214 170.48.10.149 172.16.0.44 TCP 1434 443 → 63885 [ACK] Seq=4870 Ack=2073 Win=6212 Len=1368 TSval=3318738288 TSecr=2072913683 [TCP segment of a reassembled PDU]
68 1.765363 170.48.10.149 172.16.0.44 TCP 1434 443 → 63885 [ACK] Seq=6238 Ack=2073 Win=6212 Len=1368 TSval=3318738288 TSecr=2072913683 [TCP segment of a reassembled PDU]
69 1.765400 172.16.0.44 170.48.10.149 TCP 66 63885 → 443 [ACK] Seq=2073 Ack=7606 Win=65535 Len=0 TSval=2072913762 TSecr=3318738288
70 1.765439 170.48.10.149 172.16.0.44 TCP 805 [TCP Previous segment not captured] 443 → 63885 [PSH, ACK] Seq=8974 Ack=2073 Win=6212 Len=739 TSval=3318738288 TSecr=2072913683 [TCP segment of a reassembled PDU]
71 1.765480 172.16.0.44 170.48.10.149 TCP 78 [TCP Dup ACK 69#1] 63885 → 443 [ACK] Seq=2073 Ack=7606 Win=65535 Len=0 TSval=2072913762 TSecr=3318738288 SLE=8974 SRE=9713
72 1.765557 170.48.10.149 172.16.0.44 TCP 1434 [TCP Out-Of-Order] 443 → 63885 [ACK] Seq=7606 Ack=2073 Win=6212 Len=1368 TSval=3318738288 TSecr=2072913683
73 1.765589 172.16.0.44 170.48.10.149 TCP 66 63885 → 443 [ACK] Seq=2073 Ack=9713 Win=65535 Len=0 TSval=2072913762 TSecr=3318738288
74 1.843455 170.48.10.149 172.16.0.44 TCP 1434 [TCP Out-Of-Order] 443 → 63885 [ACK] Seq=7606 Ack=2073 Win=6212 Len=1368 TSval=3318738367 TSecr=2072913762[Reassembly error, protocol TCP: New fragment overlaps old data (retransmission?)]
75 1.843491 172.16.0.44 170.48.10.149 TCP 78 [TCP Dup ACK 73#1] 63885 → 443 [ACK] Seq=2073 Ack=9713 Win=65535 Len=0 TSval=2072913840 TSecr=3318738288 SLE=7606 SRE=8974

Sheraz.Salim · ‎03-10-2020

Is the issue is with only https://cignaaccess.cigna.com/public/app/signin or all other website? there can be many reason if the website is not responding.

please do not forget to rate.

Cristian Matei · ‎03-12-2020

Hi,

Is the traffic inspected by the IPS or CX module? If so, set the module in "monitor-only" and see if it works.If it works, look at the IPS/CX configuration. If it doesn't work, make a packet capture on the ASA for this specific traffic, on both ingress and egress interfaces and post it.

Regards,

Cristian Matei.