--- title: "HPAQ Question 6 Answer: Misconfigured Ethernet Interfaces" description: Misconfiguration of Ethernet interfaces is one of common problems at the TCP layer. Find out how you can fix this problem with simple steps. image: https://insights.profitap.com/hubfs/SuperHeroes-Answer-6-1.jpg --- [![Profitap](https://insights.profitap.com/hubfs/profitap-logo-white-rev1.png "Profitap")](https://www.profitap.com) - [Solutions](https://www.profitap.com/solutions/) - Products - Resources - Company - - - - # Profitap Blog ### Recent Posts ### Categories - [Network Monitoring (75)](https://insights.profitap.com/topic/network-monitoring) - [Insights (38)](https://insights.profitap.com/topic/insights) - [IOTA (32)](https://insights.profitap.com/topic/iota) - [Copper TAPs (31)](https://insights.profitap.com/topic/copper-taps) - [ProfiShark (24)](https://insights.profitap.com/topic/profishark) - [Fiber TAPs (23)](https://insights.profitap.com/topic/fiber-taps) - [Data Center (17)](https://insights.profitap.com/topic/data-center) - [Network Packet Brokers (14)](https://insights.profitap.com/topic/network-packet-brokers) - [Network Visibility and Cybersecurity (14)](https://insights.profitap.com/topic/network-visibility-and-cybersecurity) - [Network Security (13)](https://insights.profitap.com/topic/network-security) - [News (13)](https://insights.profitap.com/topic/news) - [Product Update (11)](https://insights.profitap.com/topic/product-update) - [Field Service (10)](https://insights.profitap.com/topic/field-service) - [Case Study (3)](https://insights.profitap.com/topic/case-study) - [OIDA (3)](https://insights.profitap.com/topic/oida) - [Events (2)](https://insights.profitap.com/topic/events) - [Heroes of Packet Analysis (2)](https://insights.profitap.com/topic/heroes-of-packet-analysis) - [Solutions for Government and Defense (2)](https://insights.profitap.com/topic/solutions-for-government-and-defense) - [Power and Utilities Solutions (1)](https://insights.profitap.com/topic/power-and-utilities-solutions) - [Solutions for Logistics (1)](https://insights.profitap.com/topic/solutions-for-logistics) - [cloud (1)](https://insights.profitap.com/topic/cloud) see all ### Archives - [July 2026 (1)](https://insights.profitap.com/archive/2026/07) - [June 2026 (1)](https://insights.profitap.com/archive/2026/06) - [May 2026 (3)](https://insights.profitap.com/archive/2026/05) - [April 2026 (2)](https://insights.profitap.com/archive/2026/04) - [March 2026 (3)](https://insights.profitap.com/archive/2026/03) - [February 2026 (3)](https://insights.profitap.com/archive/2026/02) - [January 2026 (3)](https://insights.profitap.com/archive/2026/01) - [November 2025 (1)](https://insights.profitap.com/archive/2025/11) - [October 2025 (4)](https://insights.profitap.com/archive/2025/10) - [September 2025 (1)](https://insights.profitap.com/archive/2025/09) - [August 2025 (2)](https://insights.profitap.com/archive/2025/08) - [July 2025 (3)](https://insights.profitap.com/archive/2025/07) - [May 2025 (1)](https://insights.profitap.com/archive/2025/05) - [March 2025 (2)](https://insights.profitap.com/archive/2025/03) - [February 2025 (3)](https://insights.profitap.com/archive/2025/02) - [January 2025 (2)](https://insights.profitap.com/archive/2025/01) - [December 2024 (1)](https://insights.profitap.com/archive/2024/12) - [November 2024 (2)](https://insights.profitap.com/archive/2024/11) - [October 2024 (1)](https://insights.profitap.com/archive/2024/10) - [September 2024 (3)](https://insights.profitap.com/archive/2024/09) - [August 2024 (8)](https://insights.profitap.com/archive/2024/08) - [July 2024 (7)](https://insights.profitap.com/archive/2024/07) - [June 2024 (1)](https://insights.profitap.com/archive/2024/06) - [May 2024 (6)](https://insights.profitap.com/archive/2024/05) - [April 2024 (1)](https://insights.profitap.com/archive/2024/04) - [March 2024 (3)](https://insights.profitap.com/archive/2024/03) - [February 2024 (2)](https://insights.profitap.com/archive/2024/02) - [January 2024 (1)](https://insights.profitap.com/archive/2024/01) - [December 2023 (2)](https://insights.profitap.com/archive/2023/12) - [November 2023 (1)](https://insights.profitap.com/archive/2023/11) - [July 2023 (1)](https://insights.profitap.com/archive/2023/07) - [June 2023 (1)](https://insights.profitap.com/archive/2023/06) - [April 2023 (1)](https://insights.profitap.com/archive/2023/04) - [February 2023 (1)](https://insights.profitap.com/archive/2023/02) - [January 2023 (1)](https://insights.profitap.com/archive/2023/01) - [December 2022 (1)](https://insights.profitap.com/archive/2022/12) - [October 2022 (1)](https://insights.profitap.com/archive/2022/10) - [April 2022 (1)](https://insights.profitap.com/archive/2022/04) - [March 2022 (1)](https://insights.profitap.com/archive/2022/03) - [February 2022 (2)](https://insights.profitap.com/archive/2022/02) - [January 2022 (1)](https://insights.profitap.com/archive/2022/01) - [December 2021 (2)](https://insights.profitap.com/archive/2021/12) - [October 2021 (2)](https://insights.profitap.com/archive/2021/10) - [September 2021 (1)](https://insights.profitap.com/archive/2021/09) - [August 2021 (1)](https://insights.profitap.com/archive/2021/08) - [June 2021 (1)](https://insights.profitap.com/archive/2021/06) - [May 2021 (1)](https://insights.profitap.com/archive/2021/05) - [March 2021 (2)](https://insights.profitap.com/archive/2021/03) - [February 2021 (1)](https://insights.profitap.com/archive/2021/02) - [January 2021 (2)](https://insights.profitap.com/archive/2021/01) - [November 2020 (1)](https://insights.profitap.com/archive/2020/11) - [September 2020 (1)](https://insights.profitap.com/archive/2020/09) - [August 2020 (1)](https://insights.profitap.com/archive/2020/08) - [July 2020 (2)](https://insights.profitap.com/archive/2020/07) - [June 2020 (2)](https://insights.profitap.com/archive/2020/06) - [April 2020 (2)](https://insights.profitap.com/archive/2020/04) - [March 2020 (2)](https://insights.profitap.com/archive/2020/03) - [February 2020 (4)](https://insights.profitap.com/archive/2020/02) - [September 2019 (1)](https://insights.profitap.com/archive/2019/09) - [August 2019 (1)](https://insights.profitap.com/archive/2019/08) - [May 2019 (2)](https://insights.profitap.com/archive/2019/05) - [April 2019 (1)](https://insights.profitap.com/archive/2019/04) - [March 2019 (1)](https://insights.profitap.com/archive/2019/03) - [February 2019 (1)](https://insights.profitap.com/archive/2019/02) - [December 2018 (2)](https://insights.profitap.com/archive/2018/12) - [October 2018 (2)](https://insights.profitap.com/archive/2018/10) - [August 2018 (1)](https://insights.profitap.com/archive/2018/08) - [July 2018 (2)](https://insights.profitap.com/archive/2018/07) - [June 2018 (1)](https://insights.profitap.com/archive/2018/06) - [May 2018 (4)](https://insights.profitap.com/archive/2018/05) - [April 2018 (1)](https://insights.profitap.com/archive/2018/04) - [March 2018 (2)](https://insights.profitap.com/archive/2018/03) - [February 2018 (1)](https://insights.profitap.com/archive/2018/02) - [January 2018 (1)](https://insights.profitap.com/archive/2018/01) - [December 2017 (1)](https://insights.profitap.com/archive/2017/12) - [November 2017 (2)](https://insights.profitap.com/archive/2017/11) - [October 2017 (1)](https://insights.profitap.com/archive/2017/10) - [July 2017 (1)](https://insights.profitap.com/archive/2017/07) - [May 2017 (2)](https://insights.profitap.com/archive/2017/05) - [February 2016 (1)](https://insights.profitap.com/archive/2016/02) - [December 2015 (2)](https://insights.profitap.com/archive/2015/12) - [June 2015 (2)](https://insights.profitap.com/archive/2015/06) - [May 2015 (3)](https://insights.profitap.com/archive/2015/05) see all ### Stay up to date [Follow @Profitap](https://twitter.com/Profitap?ref_src=twsrc%5Etfw) [Return to Blog](https://insights.profitap.com/) # HPAQ Question 6 Answer: Misconfigured Ethernet Interfaces - [Tweet](https://twitter.com/share) “A new application server has been installed in the DMZ and the DBA is using SQL\*Plus to make a connection to the Database server in the internal network. The connection seems to start OK, but then freezes. Pressing CTRL+C is also ignored and won't get the DBA back to the command prompt.” During the test, all packets to/from the Database server were captured on the application server. Have a look at the packets and pick the correct answer ([click to download trace file](https://insights.profitap.com/hubfs/Q6-Sake.pcapng)).   Possible Answers: A.  The 'TCP Previous segment not captured' message in frame 20 means that one or more packets from the Database server were not written to the pcap file, even though the application server received them properly. B. The Database server did not receive packet 18 so the client sends a retransmission after a retransmission-timeout (RTO) of 200ms. C. There is a mismatch in the configuration of the Ethernet interfaces on the two servers and the firewall. D. The URG flag in frame 21 is used by the SQL\*Plus client to try to speed up the connection process. E. There is a bug in the SQL\*Plus client that makes it send out a packet that the database server does not understand, so it does not respond to the request in packet 18 and 19.   ![Misconfigured ethernet interfaces](https://insights.profitap.com/hs-fs/hubfs/AdobeStock_60596468.jpeg?width=808&name=AdobeStock_60596468.jpeg) ## **Retransmissions and missing data** The packets were indeed captured on the application server (192.168.0.10). This can be checked by looking at the 3-way handshake. There is a delta of 981 microseconds between the SYN and the SYN/ACK. Then there is an 18 microsecond delta between the SYN/ACK and the ACK. This means the capture was made on (or at least very near) to the sender of the SYN and the ACK. By looking at the 3-way handshake, we also learned that the RTT between the application server (APP) and the database server (DB) is about 1 millisecond. Up until frame 18, everything looks fine. There are requests from the APP to the DB and the DB is responding quickly (1-25 milliseconds). But there is no response to the request in frame 18. Not even a bare ACK. ~200ms later the request is repeated by hitting the retransmission-timeout (RTO). The retransmission does get ACKed in frame 20. But it is marked with “\[TCP Previous segment not captured\]”. This is because in the last frame of the DB (frame 17), the next expected sequence number was 913, but now the sequence number from the DB is 3092. Wireshark did not see 2179 bytes of data and alerts with “\[TCP Previous segment not captured\]”. To validate answer “A”, we need some proof of whether the APP saw that data or not. In frame 21, the APP is sending data again (after 12 seconds of silence), with an ACK value of 913. This means the APP also did not see the data and it was not a capturing problem. This means answer “A” is incorrect.   ## URG flag is not used to speed up the connection If we look more closely to the ACK in frame 20, we can see a SACK block with a left edge of 1047 and a right edge of 2383. Because the ACK value is 2383, this means this is not a selective acknowledgement (SACK), but a selective duplicate acknowledgement (DSACK). A DSACK tells the sending side it received a part of the data twice. In this case it received bytes 1047-2383 twice. Because of this DSACK we know the DB received both frame 18 and frame 19 in which bytes 1047-2383 were sent. This means answer “B” is incorrect as even though there was indeed an RTO re-transmission, this was not caused by the DB not receiving packet 18. The fact that there were 2179 bytes being sent from the DB in response to having received packet 18 also means answer “E” is incorrect, as the DB did respond to the request from the APP in packet 18. Then frame 20 has the URG flag set. This is caused by pressing CTRL+C on the APP. What the URG flag means is that the URG pointer field is significant. And the URG pointer field is used to mark (part of the) TCP segment data as urgent, as more important than other bytes of the segment data. In this case it marks the whole segment as urgent, because it wants the other side to take notice of the CTRL+C before processing other outstanding data in the TCP buffer. So, the URG flag is not used to speed up the connection, it is used to prioritize the closing of the session. And this means answer “D” is also incorrect. ## Mismatch configuration between the Ethernet, the servers and the firewall This leaves answer “**C**” to be the correct answer. But how does a problem at the TCP layer be caused by a misconfiguration of the Ethernet interfaces. For that, we need to take a second look at the 3-way handshake. Both the SYN from the APP and the SYN/ACK from the DB have an MSS value of 8960. This means both the APP and the DB have an MTU of 9000 configured on their Ethernet interface. The response of the DB to the request from the APP in frame 18 has a length of 2179 bytes. Because of the MSS of 8960, this response was sent in one segment. The resulting packet was sent over the routers and switches to the firewall. But the firewall is configured with a default MTU size of 1500 on all of its Ethernet interfaces and therefore it drops this over-sized packet. The DB retransmits this packet over and over again, but the firewall drops each and every retransmission too. And that is why the connection freezes, the APP has sent its request (and it did get an ACK on the retransmission), so it waits on the DB and the DB has sent the response, but the TCP layer has a problem delivering it to the APP. There are several possible solutions to this problem. But since the APP needs to communicate with systems on the Internet with an MTU of 1500, we changed the MTU on the APP to 1500. Now it sends out an MSS of 1460 forcing the DB to segment larger responses into segments of 1460 bytes.   Don't forget to check [Wireshark Filters](https://insights.profitap.com/14-powerful-wireshark-filters-to-use) article if you want to learn more about a portable network capture solution that flawlessly integrates with Wireshark or have a look at other [Wireshark Filters that our engineers use.](https://insights.profitap.com/14-powerful-wireshark-filters-to-use)   [![Heroes of Packet Analysis Quiz Answer 6 Explained](https://no-cache.hubspot.com/cta/default/2954816/597b9a82-3c4b-4873-b656-74daba06f0a1.png)](https://cta-redirect.hubspot.com/cta/redirect/2954816/597b9a82-3c4b-4873-b656-74daba06f0a1) - [Tweet](https://twitter.com/share) by [Profitap](https://insights.profitap.com/author/profitap) | Apr 21, 2020 | [Insights](https://insights.profitap.com/topic/insights), [Copper TAPs](https://insights.profitap.com/topic/copper-taps), [Fiber TAPs](https://insights.profitap.com/topic/fiber-taps), [Data Center](https://insights.profitap.com/topic/data-center), [Field Service](https://insights.profitap.com/topic/field-service) [**Packet Capture & Analysis**](https://www.profitap.com/iota/) - [IOTA 1G](https://www.profitap.com/iota-1g/) - [IOTA 1G+](https://www.profitap.com/iota-1g-plus/) - [IOTA 10G](https://www.profitap.com/iota-10g/) - [IOTA 10G+](https://www.profitap.com/iota-10g-plus/) - [IOTA 10 CORE](https://www.profitap.com/iota-10-core/) - [IOTA 10 CORE+](https://www.profitap.com/iota-10-core-plus/) - [IOTA 100 CORE](https://www.profitap.com/iota-100-core/)   [**ProfiShark**](https://www.profitap.com/profishark-network-taps/) - [ProfiShark 100M](https://www.profitap.com/profishark-100m/) - [ProfiShark 1G](https://www.profitap.com/profishark-1g/) - [ProfiShark 1G+](https://www.profitap.com/profishark-1g-plus/) - [ProfiShark 10G](https://www.profitap.com/profishark-10g/) - [ProfiShark 10G+](https://www.profitap.com/profishark-10g-plus/)   [**Accessories**](https://www.profitap.com/accessories/) - [Transceivers](https://www.profitap.com/transceivers/) - [Data Diodes](https://www.profitap.com/data-diodes/) - [Connectivity](https://www.profitap.com/accessories/#connectivity/) [**Network Traffic Aggregators**](https://www.profitap.com/network-traffic-aggregators/) - [XX-720G](https://www.profitap.com/xx-720g-network-packet-broker/) - [XX-1800G](https://www.profitap.com/xx-1800g-network-packet-broker/) - [XX-3200G](https://www.profitap.com/xx-3200g-network-packet-broker/)   [**Network Packet Brokers**](https://www.profitap.com/network-packet-brokers/) - [X3-Series](https://www.profitap.com/x3-series-advanced-network-packet-brokers/) - [X2-2010G](https://www.profitap.com/x2-2010g-network-packet-broker/) - [X2-3200G](https://www.profitap.com/x2-3200g-network-packet-broker/) - [X2-6400G](https://www.profitap.com/x2-6400g-network-packet-broker/) - [X2-12800G](https://www.profitap.com/x2-12800g-network-packet-broker/)   **NPB Features** - [Data Masking](https://www.profitap.com/data-masking/) - [Timestamping](https://www.profitap.com/timestamping/) - [Packet Deduplication](https://www.profitap.com/packet-deduplication/) - [Tunneling & De-tunneling](https://www.profitap.com/tunneling-de-tunneling/) - [Packet Slicing](https://www.profitap.com/packet-slicing/) - [GTP IP Filtering](https://www.profitap.com/gtp-ip-filtering/) [**Network TAPs**](https://www.profitap.com/network-taps/) - [Secure TAPs](https://www.profitap.com/secure-data-access/) - [Fiber TAPs](https://www.profitap.com/fiber-taps/) - [Copper TAPs](https://www.profitap.com/copper-taps/) - [Aggregation TAPs](https://www.profitap.com/aggregation-taps/) - [Bypass TAPs](https://www.profitap.com/bypass-taps/) - [Regeneration TAPs](https://www.profitap.com/regeneration-taps/) - [Replication TAPs](https://www.profitap.com/replication-taps/)   **Cloud Visibility** - [VMware](https://www.profitap.com/vtap/) - [Kubernetes](https://www.profitap.com/cloud-tap/) - [AWS EKS](https://www.profitap.com/cloud-tap/) - [Azure VM](https://www.profitap.com/cloud-tap/#azure)   **Centralized Management** - [IOTA CM](https://www.profitap.com/iota-cm/) - [Supervisor](https://www.profitap.com/supervisor/)   [**Solutions**](https://www.profitap.com/solutions/) - [Performance analysis & diagnostics](https://www.profitap.com/performance-analysis-and-diagnostics-solutions/) - [Network troubleshooting](https://www.profitap.com/network-troubleshooting-solutions/) - [Packet forensics](https://www.profitap.com/packet-forensics-solutions/) - [Network security](https://www.profitap.com/network-security-solutions/) - [ICS/OT network monitoring](https://www.profitap.com/ics-ot-network-monitoring-solutions/) [**About Us**](https://www.profitap.com/our-story/) - [Our Story](https://www.profitap.com/our-story/) - [Events](https://www.profitap.com/events/) - [Careers](https://jobs.profitap.com/) - [News](https://news.profitap.com/)   **Resources** - [Knowledge Base](https://kb.profitap.com/) - [Software & Drivers](https://resources.profitap.com/) - [Product Portfolio](https://www.profitap.com/portfolio/) - [Blog](https://insights.profitap.com/) - [Library](https://www.profitap.com/library/) - [Product Updates](https://www.profitap.com/product-updates/) - [Academy](https://www.profitap.com/academy/)   **Partners** - [Partner with Us](https://www.profitap.com/partner-with-us/) - [Our Partners](https://www.profitap.com/our-partners/) - [Locate a Reseller](https://www.profitap.com/locate-a-reseller/)   **Contact** - [Contact Us](https://www.profitap.com/contact-us/) - [Professional Services](https://www.profitap.com/professional-services/) - [Get a Quote](https://www.profitap.com/get-a-quote/) --- © 2026 Profitap HQ B.V. and its licensors. All Rights Reserved — Profitap HQ B.V., High Tech Campus 84, 5656 AG Eindhoven, The Netherlands | [Privacy Policy](https://www.profitap.com/privacy-policy/) | [Terms and Conditions](https://www.profitap.com/terms-and-conditions/) ```json { "@context" : "http://schema.org", "@type" : "Blog", "author" : { "@type" : "Person", "name" : "Profitap" }, "dateModified" : "April 21, 2020, 11:17:52 AM", "datePublished" : "2020-04-21 11:17:52", "description" : "Misconfiguration of Ethernet interfaces is one of common problems at the TCP layer. Find out how you can fix this problem with simple steps.", "headline" : "HPAQ Question 6 Answer: Misconfigured Ethernet Interfaces", "image" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/2954816/SuperHeroes-Answer-6-1.jpg" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/2954816/Logos/Profitap-logo-black-orange-whitebg.png" }, "name" : "Profitap HQ B.V." } } ```