It appears we might have an issue with our RV082 (v4.2.1.02) dropping packets during the teardown of many TCP conversations. I have attached two packet captures of what I believe is the same conversation. One is from outside the router (Wireshark using an Ethernet Tap) and the other is from the client inside the router (SLES11SP2 running TCPDump). These are both very small captures 9 packets and 18 packets and I'm hoping it will help identify the problem.
It appears that the RV082 is prematurely closing the natted port used to communicate with the host outside the network. The host sends a FIN, ACK packet, to which the client responds with an ACK, However, when the client then sends his FIN,ACK sequence, it never makes it outside the router. The client sends a total of 9 FIN,ACKs trying to contact the outside server, but none of those appear to make it through the router.
Am I missing somethinge here or is the router slamming the door prematurely? (I've been fighting with this problem for 3 weeks now!)
Inside Capture:
----------------------
No. Time Source Destination Protocol Length Info
1 2013-02-13 19:32:37.827942 192.168.1.45 38.113.116.214 TCP 76 35975 > http [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=635644783 TSecr=0 WS=128
2 2013-02-13 19:32:37.895107 38.113.116.214 192.168.1.45 TCP 76 http > 35975 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 SACK_PERM=1 TSval=1318450816 TSecr=635644783 WS=128
3 2013-02-13 19:32:37.895137 192.168.1.45 38.113.116.214 TCP 68 35975 > http [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=635644800 TSecr=1318450816
4 2013-02-13 19:32:37.895210 192.168.1.45 38.113.116.214 HTTP 1007 POST /SpamResolverNG/SpamResolverNG.dll?DoNewRequest HTTP/1.0
5 2013-02-13 19:32:37.965325 38.113.116.214 192.168.1.45 TCP 68 http > 35975 [ACK] Seq=1 Ack=940 Win=7680 Len=0 TSval=1318450887 TSecr=635644800
6 2013-02-13 19:32:37.966121 38.113.116.214 192.168.1.45 HTTP 377 HTTP/1.1 200 OK (text/html)
7 2013-02-13 19:32:37.966142 192.168.1.45 38.113.116.214 TCP 68 35975 > http [ACK] Seq=940 Ack=310 Win=15744 Len=0 TSval=635644818 TSecr=1318450887
8 2013-02-13 19:32:43.020843 38.113.116.214 192.168.1.45 TCP 68 http > 35975 [FIN, ACK] Seq=310 Ack=940 Win=7680 Len=0 TSval=1318455942 TSecr=635644818
9 2013-02-13 19:32:43.060371 192.168.1.45 38.113.116.214 TCP 68 35975 > http [ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635646092 TSecr=1318455942
10 2013-02-13 19:33:22.451561 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635655939 TSecr=1318455942
11 2013-02-13 19:33:22.752382 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635656015 TSecr=1318455942
12 2013-02-13 19:33:23.364378 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635656167 TSecr=1318455942
13 2013-02-13 19:33:24.580357 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635656472 TSecr=1318455942
14 2013-02-13 19:33:27.020379 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635657082 TSecr=1318455942
15 2013-02-13 19:33:31.892381 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635658300 TSecr=1318455942
16 2013-02-13 19:33:41.636381 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635660736 TSecr=1318455942
17 2013-02-13 19:34:01.156385 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635665616 TSecr=1318455942
18 2013-02-13 19:34:40.132389 192.168.1.45 38.113.116.214 TCP 68 35975 > http [FIN, ACK] Seq=940 Ack=311 Win=15744 Len=0 TSval=635675360 TSecr=1318455942
Outside Capture:
-------------------------
No. Time Source Destination Protocol Length Info
1 2013-02-13 19:30:03.969765 67.52.35.90 38.113.116.214 TCP 74 64437 > http [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=637422263 TSecr=0 WS=128
2 2013-02-13 19:30:04.073302 38.113.116.214 67.52.35.90 TCP 74 http > 64437 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 SACK_PERM=1 TSval=1325560664 TSecr=637422263 WS=128
3 2013-02-13 19:30:04.073965 67.52.35.90 38.113.116.214 TCP 66 64437 > http [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=637422289 TSecr=1325560664
4 2013-02-13 19:30:04.074467 67.52.35.90 38.113.116.214 HTTP 1006 POST /SpamResolverNG/SpamResolverNG.dll?DoNewRequest HTTP/1.0
5 2013-02-13 19:30:04.186232 38.113.116.214 67.52.35.90 TCP 66 http > 64437 [ACK] Seq=1 Ack=941 Win=7680 Len=0 TSval=1325560775 TSecr=637422289
6 2013-02-13 19:30:04.187020 38.113.116.214 67.52.35.90 HTTP 382 HTTP/1.1 200 OK (text/html)
7 2013-02-13 19:30:04.187641 67.52.35.90 38.113.116.214 TCP 66 64437 > http [ACK] Seq=941 Ack=317 Win=15744 Len=0 TSval=637422318 TSecr=1325560776
8 2013-02-13 19:30:09.242601 38.113.116.214 67.52.35.90 TCP 66 http > 64437 [FIN, ACK] Seq=317 Ack=941 Win=7680 Len=0 TSval=1325565832 TSecr=637422318
9 2013-02-13 19:30:09.280536 67.52.35.90 38.113.116.214 TCP 66 64437 > http [ACK] Seq=941 Ack=318 Win=15744 Len=0 TSval=637423591 TSecr=1325565832
