I would run two capture statements on the pix:
One on the interface closest to the client and the ohter on the interface closest to the server.
On the client side, code an acl as follows:
access-l cap01 permit ip host client-ip host server-ip
access-l cap01 permit ip host server-ip host client-ip
where client-ip is the true address of a client (use only one cliet for this test to make the troubleshooting easier) and server-ip is the server address as seen by the client.
On the server intf capture you would code a similar acl using cap02 as the acl name with these notes: client-ip will be the client's address as seen by the server so if you are using nat/pat for these connections, then it will be whatever you nat/pat to. Server-ip is the true ip address of the server.
You can run multiple capture statements one using acl cap01 in client intf and the other usering acl cap02 on the server intf at the same time.
Please post both capture results here after the error occurs. You can use a packet-l of 256 and a buffer of 40960 or higher - and you may want to do this when there is little production traffic or load on the pix.
