[plug] remote site cannot send attachments

[Michael Collard]

On Thu, 2005-02-24 at 23:28 +0800, Jon Miller wrote:
> I have a problem that I nor some of the vendors can solve and I'm hoping someone can shine some light on the subject.  The layout is a VPN network in a Hub-an-spoke configuration using Cisco 2621 at the hub and Cisco 837 and Cisco 1721 as spokes.  On the majority of the spokes the workstations are connected to a switch and the switch to the router.  The mail server is a Linux Debian server with postfix and Sophos MailMonitor on it.  The mail is scanned by MM and past on to Postfix where it is delivered to the mailbox. 
> The problem is the following:
> When a user sends a regular email from either Netscape v7 or OL2K it goes through ok.
> When the same user sends an e-mail with an attachment it hangs and eventually times-out.
> The last line of the capture is where we are puzzled.  The attachment is the ReadMe file from Radmin and the program only get halfway through it and then it has the 451 error on the line.  I've asked Sophos but they do not have a clue as to what is going on.
> The routers on the spokes have a MTU size of 1436 and the hub router has a MTU size of 1492.
> I've noticed that there is a packet that states 
> [TCP Analysis Flags]
>     [This is a TCP Duplicate ack]
> [Duplicate ACK #: 1]
> [Duplicate to the ACK in frame: 1284]
> Not sure what this means except that it's a duplicate of the previous packet.  But the question is why?
> 
> I would appreciate any light someone and put on the subject. 
> This is the content of a TCP stream from the capture. I've deleted about 25 lines of text to minimise the size of the capture.

<snip>

You might find that the MTU of 1492 on the hub router is too high with
the tunnelling etc (for other hosts). I also want to know where the
mailserver is with respect to this network as it could cause this too.
For a simple test, try dropping the MTU on the workstation to 1280 using
DrTCP.

Good luck!

Michael Collard