Corruption in the network stack

Question

Hi,

What could cause WireShark to show (example) 'xxxxxxxxxxx' on the sending machine, and then show 'xxxxxxxxxii' on the receiving machine? Note that it's not WireShark showing wrong data, the data is actually corrupted when it arrives, causing our TCP/IP protocol to get out of sync.

This is not the real data sent, but this is the pattern of what is happening. First some bytes that is equal on both sides, and then some bytes that doesn't match on the receiving side (seems to always be 11 bytes but I dont have enough data for real statistics).

It is not terribly hard to reproduce, but on the other hand it doesn't happen all the time either.

The sending side is C# on Vista and the receiver is Windows XP or Windows Server 2003, using C++ and Windows sockets. But since we check the data with WireShark I suppose that shouldn't matter...

Answer 1

I have seen that before where it was solved by replacing the router.

Answer 2

As Wireshark name suggests, it shows data transferred over wire. Whatever you are sending and receiving will be shown as-it-is.

Check for protocol stake implementation details like:

1. IPV6 issue
2. What kind of data-link protocol is running
3. Are you using any specialized NIC, some of them do checksum offloading( here )
4. What exactly corruption look like? Which specific byte its appearing? Is it in TCP header/ IP header?