I would like some help in identifying a missing Packet in a TCP Stream.
I have an Application Layer Firewall where I can filter specific Web sites and Applications.
When I access a simple Website from a Client with the IP 172.16.11.3/16 my Firewall will correctly identify the website I accessed.
When I change the IP address from this Client to 172.16.10.3/16 my Firewall will not identify the website anymore.
Please note that everything stays the same, the only difference is one octet in the IP.
In order to find the problem I did a packet capture on the Firewall and I can see that there is indeed a difference. From the non-working IP, I am missing one single TCP Packet in my sequence indifference to the working IP.
Following is a Screenshot of the problematic Packet being blue:
My assumption is that the Firewall is missing a Packet in the TCP Stream and can therefore not correctly identify the Application.
My Question: Can anyone tell me if my assumption is feasible and could anyone guess what could cause the TCP Stream to look different? My money is on a buggy Core Switch between Client and Firewall.
Edited to add:
I captured the traffic on the internal interface of the firewall before the firewall process even gets the traffic. Configuration or type of Firewall should not be relevant. On top of that, I can replicate this behavior on a different firewall which is connected to a mirror port.
Networktopo is pretty easy: Client 10.3 or 11.3 <- Client Network 172.16.0.0/16 -> L3 Core <- Transportnetwork 172.20.5.0/24 -> Firewall
Capture where logging is not working as intended and my Packet is missing: https://www.cloudshark.org/captures/8d271219db64
Capture where the traffic gets logged as intended: https://www.cloudshark.org/captures/960191af2a44