Revision history  [back]

It doesn't look like client timer inactivity because the client is only sending a GET for a PNG. Most likely, it is 10.21.8.54 sending a TCP RESET instead of retransmitting the data segment, because it has reached the" maximum number of times it will retransmit an individual data segment". Active TCP sessions utilize resources, and it makes sense to abort any broken TCP sessions.

The real issue is to determine why the client, 192.168.120.105, is not responding to the larger TCP segment(s). Try to capture at 192.168.120.105, to verify if the server's larger TCP segment made it. The alternative, is to ping the same size packet as the larger TCP segment with the do-not-frag option.