Wireshark Analysis

subhojithalder198 · ‎01-14-2014

Hi,

Pls find the capture of Wireshark

Soruce:10.190.190.170

Destination:199.255.140.136

Websense IP: 10.190.147.28

We have webfiltering server(websense), So Any traffic which going to Internet it will be filtered via websense, We are suspecting some issue in Websense, but not able to get any relevant details from the capture

Can anybody help

Urgent help will be highly appreciated

Br/Subhojit

devils_advocate · ‎01-15-2014

Hi

You have not said what the actual issue is?

What are the symptoms?

Can you diagram your setup?

Thanks

subhojithalder198 · ‎01-15-2014

Hi,

Our actual issue is for some of the Inteent Url page can't be displayed error is coming, But when we are using this url from Other location/Public Interent it is working

We are suspecting som issue in websense

Setup

User--Access switch--core switch--Juniper Internal Fw--DMZ Segment--ASA Firewall-- Interent Switch--Internet Router--ISP Cloud

Relevant Policy in Firewall & routing already present

Br/Subhojit

Alberta Martinez · ‎01-15-2014

According to the Wireshark capture, something on the device is missing up the checksums. TCP checksums are incorrect.

The packets are received by the host (as can be seen in Wireshark), but they never reach the Destination (199.255.140.136) as the TCP checksums are incorrect.

Berta.

subhojithalder198 · ‎01-16-2014

Hi,

Not able to get you, Where to check tcp checksum is having problme / on deivce or Firewall

Br/Subhojit

Alberta Martinez · ‎01-16-2014

Tcp checksum could be on device or firewall, you need to check both of them. If the problem happens in any device of your network seems the checksum is falling on firewall.

Berta.

subhojithalder198 · ‎01-16-2014

Hi,

In that case, Can you pls share how to check tcp checksum in asa fireall / command & iptions

br/Subhojit