Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was facing a weird problem on the LAN today.

If i have some TCP connection open, then that would work perfectly fine, but the rest won't. For example, if I am logged into G-Chat (the chat in the gmail), then the chat would continue to work perfectly as it would under normal internet connection. However, if I tried to open even and/or open gmail, the connection wont establish as if my net is down.

To confirm my suspicion, I started streaming an online video (when I could), the same thing happened in between. The video continued to buffer perfectly with the same good speed as if my net is perfectly fine, but none of the other sites opened up.

Since the socket or TCP connection was already established, I believe that once a connection is established, it works but the rest of packets are being "stolen" or redirected to one or some particular addresses in the LAN.

So my question is what activity and/or software is capable of performing such a task and how does it work exactly?

Also, is there a way to stop it?

Any help is much appreciated.

share|improve this question
start wireshark and observe the traffic. If you see some RST or FIN flags out of place this might be the cause. Identify if gchat and streaming video are not using UDP while other traffic is sent via TCP. use netstat to observe if connection to websites is 'ESTABLISHED' or maybe it stays in the status 'SYN_SENT' – mnmnc Dec 18 '12 at 14:07
The chat is on TCP connection and the videos are on UDP. I didn't quite understand the wireshark check you asked me to do. What would indicate RST or FIN being out of place? I am naive on this front. I will also check the netstat when this thing next happens. – user125883 Dec 18 '12 at 14:15
TCP connection is established after 3way-handshake. First packet is sent with a specific BITS set - this setting is called a flag. There are multiple flags but the one used during the connection are SYN and ACK. First you send SYN packet to the server. If everything is ok you will receive SYN and ACK in one packet and respond with ACK. Then packets fly with PSH flag while transfering data. After all is sent you should receive FIN with last packet. If something goes Wrong you will get RST most probably. If you will see RST - check if this is from the web server you are accessing. – mnmnc Dec 18 '12 at 14:20
Okay, it happened again. I did the netstat. the status for some was ESTABLISHED which I believe are the tabs in browser which were already opened. and SYN_WAIT for the ones that I tried to open. – user125883 Dec 18 '12 at 14:30
This means Firewall or proxy between you and the server is limiting your connections or filtering some specific ones based on the criteria. You might want to speak with your ISP about that. It is possible that QOS is setup and it is limiting you to specific - like 10 - concurrent connections - this will prevent you from establishing the new ones once you reach the limit. Try closing the browser, look at netstat and when TIme_wait for previous connections disappear - try again to access webpage. – mnmnc Dec 18 '12 at 14:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.