Periodic connectivity issues to external WinBox

RouterOS General
1

Hello everyone.
I have a CHR v. 7.16 configured with whitelist access to Winbox (chain=input action=accept dst-port=8291 src-address-list=Whitelist and in Whitelist I keep my Cloud address of home router). Everything worked fine and config was untouched for quite long time, but suddenly a periodic issue appeared:

  1. Sometimes Winbox is stuck at “Logging in…”. The behavior is the same for any device behind home router (so no session issue I think).
  2. Winbox v4 gives “Downloading user logged-in information” status, swapping into red error “ERR: The remote host closed the connection”.
  3. If I telnet to 8291 from home router I see message “Connected” so there’s some connectivity for sure
  4. If I log in through VNC, I can see in log that “user x logged in through winbox” and there’s sessions active
  5. The connectivity can restore on its own and break back again

With symptoms described I think there’s a connectivity block in-between, so connection is established but no further traffic received back. How can I diagnose that - if it’s a hoster or my ISP?

P.S.: haven’t tried reboot yet as it’s a production server and had a similar problem with fresh new VPS. Other connections work fine. I know my best solution would be to do management via tunnel, but I’m curious now what causes this and if other connections can be affected but I haven’t noticed yet.

2

  1. Never allow external access to config the router. The ONLY access path using winbox should be LOCALLY from an authorized LANIP or list of admin IPs, AND via VPN where the remote user has used VPN to access the router ( and is know considered local or internal ) and the config.

  2. Telnet is another method to be avoided even locally as its not secure. Use winbox if lf local or www-ssl, or SSH, but not telnet

3

The CHR is a cloud VPS so only “local” option is VNC (but that is undesired as I like GUI most of the time). I know I should use VPN to do management, but since that already touch me, want to know what happens with it.

By telnet I meant that Winbox is port 8291 but I telnet to 8291 to check port connectivity. No telnet management for sure.

4

In cases like this the first thing to check are MTU issues - as the CHR shows a successful login, the communication must have been bi-directional at least for a while. Only one of the multiple possible paths between your home router and the CHR may be affected, which would explain why it only happens now and then.

5

If that’s MTU on multipath then it would be tricky as hell to figure out. CHR has 1500 default ether MTU and home router is 1492 (PPPoE) with mss-clamp mangle rule configured. I should also notice that I use same scheme with IPv6 (i.e. external access by whitelist) and while IPv4 connectivity is broken, I can access IPv6 Winbox normally at the same time.

6

Well, IPv6 may be routed totally differently than IPv4 so you can’t base conclusions regarding IPv4 on IPv6 behavior (and vice versa). As you already have the MSS clamping rules in place, try adjusting them to force something really defensive, like 1380 bytes, in both directions and see whether that changes anything. If it does, you can take for granted that there is some MTU isue and PMTUD is broken; if it doesn’t, it may still be an MTU issue, I have seen cases where huge packets were coming although the recipient has announced a small MSS - don’t underestimate the “packet coalescing” in virtualization, I’ve seen hypervisors to merge TCP packets from the VM if the second one came soon enough after the first one, ignoring the MSS.

7

I’ve also checked in connection tracking now that when Winbox is stuck, the connection is shown as established, meanwhile changed to “fin wait” to close or straight to close. The latter is not consistent (may be just close or fin wait first from time to time), but the amount of bytes transferred is around 1300/300 each time.

8

I am pretty sure that if you sniff at both ends filtering on ip-protocol=tcp ip-address=ip.of.the.other.device, you’ll see the CHR to try sending several times a large packet that will not reach the physical Tik.

9

That’s a cool idea, gonna do that next time connection lags. I’m not using any mangling on CHR side tho, haven’t seen any issues with connections before

10

I forgot again that you cannot set MSS in prerouting or input, so yes, might make sense to set it in output on the CHR as well. The most likely bottleneck is the ISP end of the PPPoE tunnel so it should not be necessary to do that, but who knows.

11

1 0.000000 IPs Removed TCP 88 8291 → 55013 [PSH, ACK] Seq=1 Ack=1 Win=502 Len=34
2 0.000007 IPs Removed TCP 88 [TCP Retransmission] 8291 → 55013 [PSH, ACK] Seq=1 Ack=1 Win=502 Len=34
3 0.459990 IPs Removed TCP 70 55024 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1452 WS=256 SACK_PERM
4 0.459996 IPs Removed TCP 66 [TCP Retransmission] 55024 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1452 WS=256 SACK_PERM
5 0.460055 IPs Removed TCP 66 8291 → 55024 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
6 0.460059 IPs Removed TCP 66 [TCP Retransmission] 8291 → 55024 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
7 0.499119 IPs Removed TCP 64 55024 → 8291 [ACK] Seq=1 Ack=1 Win=131328 Len=0
8 0.499124 IPs Removed TCP 60 [TCP Dup ACK 7#1] 55024 → 8291 [ACK] Seq=1 Ack=1 Win=131328 Len=0
9 0.502738 IPs Removed TCP 103 55024 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=131328 Len=45
10 0.502747 IPs Removed TCP 99 [TCP Retransmission] 55024 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=131328 Len=45
11 0.502799 IPs Removed TCP 54 8291 → 55024 [ACK] Seq=1 Ack=46 Win=64256 Len=0
12 0.502803 IPs Removed TCP 54 [TCP Dup ACK 11#1] 8291 → 55024 [ACK] Seq=1 Ack=46 Win=64256 Len=0
13 0.506384 IPs Removed TCP 105 8291 → 55024 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
14 0.506387 IPs Removed TCP 105 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
15 0.547754 IPs Removed TCP 92 55024 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=131328 Len=34
16 0.547759 IPs Removed TCP 88 [TCP Retransmission] 55024 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=131328 Len=34
17 0.547792 IPs Removed TCP 54 8291 → 55024 [ACK] Seq=52 Ack=80 Win=64256 Len=0
18 0.547794 IPs Removed TCP 54 [TCP Dup ACK 17#1] 8291 → 55024 [ACK] Seq=52 Ack=80 Win=64256 Len=0
19 0.554061 IPs Removed TCP 88 8291 → 55024 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
20 0.554064 IPs Removed TCP 88 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
21 0.593017 IPs Removed TCP 174 55024 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=131072 Len=116
22 0.593023 IPs Removed TCP 170 [TCP Retransmission] 55024 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=131072 Len=116
23 0.593044 IPs Removed TCP 54 8291 → 55024 [ACK] Seq=86 Ack=196 Win=64256 Len=0
24 0.593046 IPs Removed TCP 54 [TCP Dup ACK 23#1] 8291 → 55024 [ACK] Seq=86 Ack=196 Win=64256 Len=0
25 0.593357 IPs Removed TCP 396 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
26 0.593360 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
27 0.839975 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
28 0.839981 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
29 1.089983 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
30 1.089989 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
31 1.579983 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
32 1.579990 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
33 2.559995 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
34 2.560003 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
35 4.559948 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
36 4.559953 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
37 8.479992 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
38 8.479999 IPs Removed TCP 396 [TCP Retransmission] 8291 → 55024 [PSH, ACK] Seq=86 Ack=196 Win=64256 Len=342
39 8.559978 IPs Removed TCP 88 [TCP Retransmission] 8291 → 55013 [PSH, ACK] Seq=1 Ack=1 Win=502 Len=34
40 8.559984 IPs Removed TCP 88 [TCP Retransmission] 8291 → 55013 [PSH, ACK] Seq=1 Ack=1 Win=502 Len=34

I’ve managed to capture stuff from CHR during problem, and if I interpret this pcap correctly, there’s no big packets here

12

Wow.

So the packet that doesn’t get through has just 396 bytes. If it is indeed an MTU problem, then someone has royally screwed something (but you can check that by setting the MSS to 350); if it is something else than size that makes that packet get dropped, it is a royal screwup too but playing with MSS won’t help anything.

As you are addicted to GUI, and since a VPN connection may get blocked, will HTTPS webfig be enough? You’d have to install a certificate on the CHR, though, to be sure that you don’t show your credentials to a man in the middle. Or you can tunnel Winbox via SSH, again using an authentication by key rather than by a password. I’ve got no idea how the thought police deals with SSH, though.

13

My hosting provider recently reported troubles with their network adapter - I had losses about 5% over some specific connections only, so they migrated VM to some other host (I suppose LACP troubles on their side). Previous problems are gone after migration, so maybe this could be related. However if I understand things correct, if L3 hashing policy is used by them, the problem depends on Winbox having single or multiple simultaneous connections

14

L3 hashing depends on IP addresses (src and dst) so multiple connections (different ports) will always pass same LACP member. Only if L3+L4 hashing is used, then different connections (different src/dst port numbers) might take different LACP members.

15

Even if there are simultaneous connections, each of them is a separate TCP session, and within the same TCP session, even L3+L4 hashing always chooses the same member of the LAG. Also, taking the “wrong” path within the LAG normally does not cause the packet to be dropped, the reason why hashing is used is to prevent packets from arriving in swapped order due to overtaking (long packet goes via path A and a short one arrives right next to it, so if it took path B, it would get to the destination earlier than the long one).

16 
1	0.000000	laptop_ip	server_ip	TCP	70	52536 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
2	0.000016	laptop_ip	server_ip	TCP	70	[TCP Retransmission] 52536 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
3	0.000020	laptop_ip	server_ip	TCP	66	[TCP Retransmission] 52536 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
4	0.000125	router_ip	server_ip	TCP	66	52536 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1452 WS=256 SACK_PERM
5	0.039106	server_ip	router_ip	TCP	66	8291 → 52536 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
6	0.039156	server_ip	laptop_ip	TCP	66	8291 → 52536 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
7	0.039163	server_ip	laptop_ip	TCP	70	[TCP Retransmission] 8291 → 52536 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
8	0.039175	server_ip	laptop_ip	TCP	70	[TCP Retransmission] 8291 → 52536 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
9	0.040579	laptop_ip	server_ip	TCP	58	52536 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
10	0.040591	laptop_ip	server_ip	TCP	58	[TCP Dup ACK 9#1] 52536 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
11	0.040595	laptop_ip	server_ip	TCP	54	[TCP Dup ACK 9#2] 52536 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
12	0.040636	router_ip	server_ip	TCP	54	52536 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
13	0.049456	laptop_ip	server_ip	TCP	103	52536 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
14	0.049469	laptop_ip	server_ip	TCP	103	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
15	0.049474	laptop_ip	server_ip	TCP	99	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
16	0.049529	router_ip	server_ip	TCP	99	52536 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
17	0.088369	server_ip	router_ip	TCP	54	8291 → 52536 [ACK] Seq=1 Ack=46 Win=64256 Len=0
18	0.088396	server_ip	laptop_ip	TCP	54	8291 → 52536 [ACK] Seq=1 Ack=46 Win=64256 Len=0
19	0.088400	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 18#1] 8291 → 52536 [ACK] Seq=1 Ack=46 Win=64256 Len=0
20	0.088407	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 18#2] 8291 → 52536 [ACK] Seq=1 Ack=46 Win=64256 Len=0
21	0.092004	server_ip	router_ip	TCP	105	8291 → 52536 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
22	0.092042	server_ip	laptop_ip	TCP	105	8291 → 52536 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
23	0.092047	server_ip	laptop_ip	TCP	109	[TCP Retransmission] 8291 → 52536 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
24	0.092054	server_ip	laptop_ip	TCP	109	[TCP Retransmission] 8291 → 52536 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
25	0.094938	laptop_ip	server_ip	TCP	92	52536 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
26	0.094951	laptop_ip	server_ip	TCP	92	[TCP Fast Retransmission] 52536 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
27	0.094956	laptop_ip	server_ip	TCP	88	[TCP Fast Retransmission] 52536 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
28	0.095014	router_ip	server_ip	TCP	88	52536 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
29	0.134011	server_ip	router_ip	TCP	54	8291 → 52536 [ACK] Seq=52 Ack=80 Win=64256 Len=0
30	0.134075	server_ip	laptop_ip	TCP	54	8291 → 52536 [ACK] Seq=52 Ack=80 Win=64256 Len=0
31	0.134082	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 30#1] 8291 → 52536 [ACK] Seq=52 Ack=80 Win=64256 Len=0
32	0.134094	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 30#2] 8291 → 52536 [ACK] Seq=52 Ack=80 Win=64256 Len=0
33	0.140246	server_ip	router_ip	TCP	88	8291 → 52536 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
34	0.140274	server_ip	laptop_ip	TCP	88	8291 → 52536 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
35	0.140279	server_ip	laptop_ip	TCP	92	[TCP Retransmission] 8291 → 52536 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
36	0.140286	server_ip	laptop_ip	TCP	92	[TCP Retransmission] 8291 → 52536 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
37	0.141770	laptop_ip	server_ip	TCP	174	52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
38	0.141784	laptop_ip	server_ip	TCP	174	[TCP Fast Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
39	0.141789	laptop_ip	server_ip	TCP	170	[TCP Fast Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
40	0.141839	router_ip	server_ip	TCP	170	52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
41	0.407970	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
42	0.407995	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
43	0.408000	laptop_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
44	0.408094	router_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
45	0.723847	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
46	0.723868	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
47	0.723873	laptop_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
48	0.723959	router_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
49	1.333609	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
50	1.333628	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
51	1.333633	laptop_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
52	1.333712	router_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
53	2.539785	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
54	2.539808	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
55	2.539813	laptop_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
56	2.539898	router_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
57	4.949774	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
58	4.949793	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
59	4.949798	laptop_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
60	4.949877	router_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
61	9.758356	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
62	9.758377	laptop_ip	server_ip	TCP	174	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
63	9.758382	laptop_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
64	9.758463	router_ip	server_ip	TCP	170	[TCP Retransmission] 52536 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=116
65	13.859228	laptop_ip	server_ip	TCP	58	52536 → 8291 [FIN, ACK] Seq=196 Ack=86 Win=262656 Len=0
66	13.859254	laptop_ip	server_ip	TCP	58	[TCP Retransmission] 52536 → 8291 [FIN, ACK] Seq=196 Ack=86 Win=262656 Len=0
67	13.859260	laptop_ip	server_ip	TCP	54	[TCP Retransmission] 52536 → 8291 [FIN, ACK] Seq=196 Ack=86 Win=262656 Len=0
68	13.859356	router_ip	server_ip	TCP	54	52536 → 8291 [FIN, ACK] Seq=196 Ack=86 Win=262656 Len=0
69	19.371281	laptop_ip	server_ip	TCP	58	52536 → 8291 [RST, ACK] Seq=197 Ack=86 Win=0 Len=0
70	19.371293	laptop_ip	server_ip	TCP	58	52536 → 8291 [RST, ACK] Seq=197 Ack=86 Win=0 Len=0
71	19.371297	laptop_ip	server_ip	TCP	54	52536 → 8291 [RST, ACK] Seq=197 Ack=86 Win=0 Len=0
72	19.371337	router_ip	server_ip	TCP	54	52536 → 8291 [RST, ACK] Seq=197 Ack=86 Win=0 Len=0
73	20.031878	laptop_ip	server_ip	TCP	70	52560 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
74	20.031901	laptop_ip	server_ip	TCP	70	[TCP Retransmission] 52560 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
75	20.031906	laptop_ip	server_ip	TCP	66	[TCP Retransmission] 52560 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
76	20.032021	router_ip	server_ip	TCP	66	52560 → 8291 [SYN] Seq=0 Win=64240 Len=0 MSS=1452 WS=256 SACK_PERM
77	20.070945	server_ip	router_ip	TCP	66	8291 → 52560 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
78	20.071025	server_ip	laptop_ip	TCP	66	8291 → 52560 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
79	20.071033	server_ip	laptop_ip	TCP	70	[TCP Retransmission] 8291 → 52560 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
80	20.071049	server_ip	laptop_ip	TCP	70	[TCP Retransmission] 8291 → 52560 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
81	20.073103	laptop_ip	server_ip	TCP	58	52560 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
82	20.073120	laptop_ip	server_ip	TCP	58	[TCP Dup ACK 81#1] 52560 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
83	20.073126	laptop_ip	server_ip	TCP	54	[TCP Dup ACK 81#2] 52560 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
84	20.073198	router_ip	server_ip	TCP	54	52560 → 8291 [ACK] Seq=1 Ack=1 Win=262656 Len=0
85	20.073862	laptop_ip	server_ip	TCP	103	52560 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
86	20.073871	laptop_ip	server_ip	TCP	103	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
87	20.073875	laptop_ip	server_ip	TCP	99	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
88	20.073910	router_ip	server_ip	TCP	99	52560 → 8291 [PSH, ACK] Seq=1 Ack=1 Win=262656 Len=45
89	20.112745	server_ip	router_ip	TCP	54	8291 → 52560 [ACK] Seq=1 Ack=46 Win=64256 Len=0
90	20.112813	server_ip	laptop_ip	TCP	54	8291 → 52560 [ACK] Seq=1 Ack=46 Win=64256 Len=0
91	20.112821	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 90#1] 8291 → 52560 [ACK] Seq=1 Ack=46 Win=64256 Len=0
92	20.112832	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 90#2] 8291 → 52560 [ACK] Seq=1 Ack=46 Win=64256 Len=0
93	20.116219	server_ip	router_ip	TCP	105	8291 → 52560 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
94	20.116254	server_ip	laptop_ip	TCP	105	8291 → 52560 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
95	20.116261	server_ip	laptop_ip	TCP	109	[TCP Retransmission] 8291 → 52560 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
96	20.116269	server_ip	laptop_ip	TCP	109	[TCP Retransmission] 8291 → 52560 [PSH, ACK] Seq=1 Ack=46 Win=64256 Len=51
97	20.119482	laptop_ip	server_ip	TCP	92	52560 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
98	20.119497	laptop_ip	server_ip	TCP	92	[TCP Fast Retransmission] 52560 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
99	20.119503	laptop_ip	server_ip	TCP	88	[TCP Fast Retransmission] 52560 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
100	20.119557	router_ip	server_ip	TCP	88	52560 → 8291 [PSH, ACK] Seq=46 Ack=52 Win=262656 Len=34
101	20.158447	server_ip	router_ip	TCP	54	8291 → 52560 [ACK] Seq=52 Ack=80 Win=64256 Len=0
102	20.158496	server_ip	laptop_ip	TCP	54	8291 → 52560 [ACK] Seq=52 Ack=80 Win=64256 Len=0
103	20.158502	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 102#1] 8291 → 52560 [ACK] Seq=52 Ack=80 Win=64256 Len=0
104	20.158512	server_ip	laptop_ip	TCP	58	[TCP Dup ACK 102#2] 8291 → 52560 [ACK] Seq=52 Ack=80 Win=64256 Len=0
105	20.164708	server_ip	router_ip	TCP	88	8291 → 52560 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
106	20.164756	server_ip	laptop_ip	TCP	88	8291 → 52560 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
107	20.164762	server_ip	laptop_ip	TCP	92	[TCP Retransmission] 8291 → 52560 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
108	20.164770	server_ip	laptop_ip	TCP	92	[TCP Retransmission] 8291 → 52560 [PSH, ACK] Seq=52 Ack=80 Win=64256 Len=34
109	20.167014	laptop_ip	server_ip	TCP	158	52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
110	20.167026	laptop_ip	server_ip	TCP	158	[TCP Fast Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
111	20.167030	laptop_ip	server_ip	TCP	154	[TCP Fast Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
112	20.167072	router_ip	server_ip	TCP	154	52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
113	20.432305	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
114	20.432326	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
115	20.432331	laptop_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
116	20.432411	router_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
117	20.733453	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
118	20.733475	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
119	20.733480	laptop_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
120	20.733572	router_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
121	21.339081	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
122	21.339101	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
123	21.339106	laptop_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
124	21.339189	router_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
125	22.544176	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
126	22.544195	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
127	22.544200	laptop_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
128	22.544282	router_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
129	24.947240	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
130	24.947245	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
131	24.947248	laptop_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
132	24.947295	router_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
133	29.758478	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
134	29.758495	laptop_ip	server_ip	TCP	158	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
135	29.758500	laptop_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
136	29.758588	router_ip	server_ip	TCP	154	[TCP Retransmission] 52560 → 8291 [PSH, ACK] Seq=80 Ack=86 Win=262656 Len=100
137	39.359683	laptop_ip	server_ip	TCP	58	52560 → 8291 [RST, ACK] Seq=180 Ack=86 Win=0 Len=0
138	39.359696	laptop_ip	server_ip	TCP	58	52560 → 8291 [RST, ACK] Seq=180 Ack=86 Win=0 Len=0
139	39.359700	laptop_ip	server_ip	TCP	54	52560 → 8291 [RST, ACK] Seq=180 Ack=86 Win=0 Len=0
140	39.359772	router_ip	server_ip	TCP	54	52560 → 8291 [RST, ACK] Seq=180 Ack=86 Win=0 Len=0

This is also capture from the home router