Skip to content

Analyzing Traffic 100 to 102

Frame-by-Frame Analysis of Long Frames (>4 bytes)

Frame 1: First X.25 Data Packet

Timestamp: [23:26:22.787]
Direction: Machine 100 → Machine 102
Content: 0x09 0x00 0x21 0x13 0x00 0x19 0x00 0x66 0x00 0x64 0xFF 0xFF 0x00 0x01 0xDE 0x08
Size: 16 bytes
LAPB: N(S)=0, N(R)=0 (Information frame)
X.25: Virtual Circuit 1.19, Packet Type 0x21

Retransmitted at: [23:26:23.993] (same content)
Received by 102: [23:26:23.377] and [23:26:24.268]

Frame 2: Multi-Buffer X.25 Data Packet

Timestamp: [23:26:24.581] - [23:26:25.039] (3 parts)
Direction: Machine 100 → Machine 102

Part 1 [RSOM:True] [REOM:False]: 0x09 0x22 0x21 0x13 0x00 0x0E 0x00 0x66 0x00 0x64 0x00 0x00 0x01 0x00 0xDD 0x14

Part 2 [RSOM:False] [REOM:False]: 0x21 0x00 0x86 0xC4 0x00 0x66 0x00 0x00 0x00 0x64 0x02 0xC2 0x01 0x00

Part 3 [RSOM:False] [REOM:True]: 0x01 0x4B 0x00 0x04 0x01 0x02 0x00 0x66

Combined Size: 40 bytes
LAPB: N(S)=1, N(R)=1
X.25: Virtual Circuit 1.19, carrying application data

Received by 102: [23:26:25.737] as single concatenated frame (correct assembly)

Frame 3: Next X.25 Data Packet in Sequence

Timestamp: [23:26:27.185] - [23:26:27.371] (3 parts)
Direction: Machine 100 → Machine 102

Part 1 [RSOM:True] [REOM:False]: 0x09 0x22 0x21 0x13 0x00 0x0E 0x00 0x66 0x00 0x64 0x00 0x00 0x01 0x00 0xDD 0x14

Part 2 [RSOM:False] [REOM:False]: 0x21 0x00 0x86 0xC4 0x00 0x66 0x00 0x00 0x00 0x64 0x02 0xC2 0x01 0x00

Part 3 [RSOM:False] [REOM:True]: 0x00 0x07 0xB7 0xF0 0x01 0x02 0x00 0x66

Combined Size: 40 bytes
LAPB: N(S)=1, N(R)=1
X.25: Virtual Circuit 1.19, different application data

Received by 102: [23:26:28.827] as single concatenated frame

LAPB/X.25 Deep Frame Analysis

Frame Structure (without SYNC flags 0x7E and FCS)

| Address | Control | Information Field (X.25 Packet) |
|   1B    |   1B    |        Variable Length          |

Raw Frame Data

Frame 2: 09 22 21 13 00 0E 00 66 00 64 00 00 01 00 DD 14 21 00 86 C4 00 66 00 00 00 64 02 C2 01 00 01 4B 00 04 01 02 00 66

Frame 3: 09 66 21 13 00 0E 00 66 00 64 00 01 01 00 DD 13 21 00 86 C4 00 66 00 00 00 64 02 C2 01 00 00 07 B7 F0 01 02 00 66

LAPB Header Analysis

Address Field (Byte 0)

  • Both frames: 0x09
  • Interpretation: Non-standard address value
  • Note: Standard LAPB uses 0x01 (DTE→DCE commands) or 0x03 (DCE→DTE commands)

Control Field Analysis

Frame 2: 0x22 (00100010 binary) - Frame Type: I-frame (bit 0 = 0) - N(S) = 1: Send sequence number = 1 - P/F = 0: Poll/Final bit not set
- N(R) = 1: Receive sequence number = 1

Frame 3: 0x66 (01100110 binary)
- Frame Type: I-frame (bit 0 = 0) - N(S) = 3: Send sequence number = 3 - P/F = 0: Poll/Final bit not set - N(R) = 3: Receive sequence number = 3

X.25 Packet Layer Analysis

X.25 Header (Bytes 2-4): 21 13 00

Byte 2 (0x21): GFI + Logical Channel Group - GFI = 2: Q=0, D=0, Modulo-8 sequence numbering - LCG = 1: Logical Channel Group = 1

Byte 3 (0x13): Logical Channel Number = 19 decimal Full LCI: 1.19 (Group 1, Channel 19)

Byte 4 (0x00): Data packet with X.25 sequence numbers

Key Differences Between Frames

Byte Position Frame 2 Frame 3 Field Description
1 (Control) 0x22 0x66 LAPB sequence: N(S)=1 vs N(S)=3
11 0x00 0x01 X.25 packet sequence
15 0x14 0x13 Length field (20 vs 19 bytes)
31-34 01 4B 00 04 00 07 B7 F0 User data payload

Protocol Behavior Analysis

Normal Sequence Progression

  • Frame 2: N(S)=1, N(R)=1 (sending frame 1, expecting frame 1)
  • Frame 3: N(S)=3, N(R)=3 (sending frame 3, expecting frame 3)
  • Missing: Intermediate frame N(S)=2 between these two

X.25 Layer Operation

  • Same Virtual Circuit: Both use LCI 1.19
  • Sequential Data: Different application payloads on same circuit
  • Proper Flow Control: Acknowledgment sequence numbers advancing correctly

Conclusion

No corruption detected - this represents normal X.25 data transmission with: - Proper LAPB sequence number advancement - Different application payloads (01 4B 00 04 vs 00 07 B7 F0)
- Healthy protocol operation on virtual circuit 1.19 - Standard windowing and acknowledgment behavior

Real Issue: Not frame corruption, but likely missing acknowledgments causing multiple retransmissions of the same frames.

Comprehensive Sent vs Received Analysis

Direction: Machine 100 → Machine 102

Initial Connection Setup (LOST)

SENT: [23:25:57.844] Machine 100 → 102: 0x01 0x3F 0x00 0x64
RECEIVED: [Not found in 102 trace] STATUS: ❌ LOST

SENT: [23:25:58.623] Machine 100 → 102: 0x01 0x73 0x00 0x64  
RECEIVED: [Not found in 102 trace] STATUS: ❌ LOST

SENT: [23:25:58.952] Machine 100 → 102: 0x09 0x01 0x00 0x64
RECEIVED: [Not found in 102 trace] STATUS: ❌ LOST

Data Exchange Phase (MIXED SUCCESS)

SENT: [23:26:22.787] Machine 100 → 102: 0x09 0x00 0x21 0x13 0x00 0x19 0x00 0x66...
RECEIVED: [23:26:23.377] Machine 102: Same content
STATUS: ✅ RECEIVED (Delay: 590ms)

SENT: [23:26:23.993] Machine 100 → 102: 0x09 0x00 0x21 0x13 0x00 0x19 0x00 0x66...
RECEIVED: [23:26:24.268] Machine 102: Same content  
STATUS: 🔄 RETRANSMISSION/RECEIVED (Delay: 275ms)

SENT: [23:26:24.581-25.039] Machine 100 → 102: Multi-buffer frame 0x09 0x22...
RECEIVED: [23:26:25.737] Machine 102: Concatenated frame
STATUS: ✅ RECEIVED (Delay: 1156ms)

SENT: [23:26:25.550-26.088] Machine 100 → 102: Same multi-buffer frame
RECEIVED: [23:26:27.110] Machine 102: Same concatenated frame
STATUS: 🔄 RETRANSMISSION/RECEIVED (Delay: 1560ms)

SENT: [23:26:26.871-27.371] Machine 100 → 102: Same multi-buffer frame (3rd time)
RECEIVED: [23:26:28.827] Machine 102: Same concatenated frame  
STATUS: 🔄 RETRANSMISSION/RECEIVED (Delay: 1956ms)

Acknowledgment Frames (SUCCESSFUL)

SENT: [23:26:26.316] Machine 100 → 102: 0x09 0x29 0x00 0x64
RECEIVED: [23:26:27.409] Machine 102: 0x09 0x29 0x00 0x64
STATUS: ✅ RECEIVED (Delay: 1093ms)

SENT: [23:26:27.583] Machine 100 → 102: 0x09 0x41 0x00 0x64
RECEIVED: [23:26:29.129] Machine 102: 0x09 0x41 0x00 0x64
STATUS: ✅ RECEIVED (Delay: 1546ms)

Extended Data Frames (MULTIPLE RETRANSMISSIONS)

SENT: [23:26:29.098] Machine 100 → 102: 0x09 0x64 0x21 0x13 0x00 0x03...
RECEIVED: [23:26:29.843] Machine 102: Same content
STATUS: ✅ RECEIVED (Delay: 745ms)

SENT: [23:26:30.529] Machine 100 → 102: 0x09 0x69 0x00 0x64
RECEIVED: [23:26:31.663] Machine 102: 0x09 0x69 0x00 0x64
STATUS: ✅ RECEIVED (Delay: 1134ms)

SENT: [23:26:31.120] Machine 100 → 102: 0x09 0x64 0x21 0x13... (RETRANSMISSION)
RECEIVED: [23:26:32.329] Machine 102: Same content
STATUS: 🔄 RETRANSMISSION/RECEIVED (Delay: 1209ms)

SENT: [23:26:32.580] Machine 100 → 102: 0x09 0x64 0x21 0x13... (RETRANSMISSION)
RECEIVED: [23:26:34.409] Machine 102: Same content
STATUS: 🔄 RETRANSMISSION/RECEIVED (Delay: 1829ms)

SENT: [23:26:34.482] Machine 100 → 102: 0x09 0x64 0x21 0x13... (RETRANSMISSION)
RECEIVED: [Not found] STATUS: ❌ LOST

SENT: [23:26:36.224] Machine 100 → 102: 0x09 0x64 0x21 0x13... (RETRANSMISSION)
RECEIVED: [Not found] STATUS: ❌ LOST

CRC Error Recovery Phase (MASSIVE LOSSES)

SENT: [23:26:37.983] Machine 100 → 102: 0x01 0x3F 0x00 0x64 (Reset frame)
SENT: [23:26:38.234] Machine 100 → 102: 0x01 0x3F 0x00 0x64 (RETRANSMISSION)
SENT: [23:26:38.510] Machine 100 → 102: 0x01 0x3F 0x00 0x64 (RETRANSMISSION)
...15+ identical retransmissions...
RECEIVED: [Not found] STATUS: ❌ ALL LOST

Successful Recovery (WORKING AGAIN)

SENT: [23:26:53.153] Machine 100 → 102: 0x01 0x73 0x00 0x64
RECEIVED: [23:26:53.360] Machine 102: 0x01 0x73 0x00 0x64
STATUS: ✅ RECEIVED (Delay: 207ms)

SENT: [23:26:55.346] Machine 100 → 102: 0x09 0x01 0x00 0x64
RECEIVED: [23:26:55.828] Machine 102: 0x09 0x01 0x00 0x64
STATUS: ✅ RECEIVED (Delay: 482ms)

Direction: Machine 102 → Machine 100

Response Frames (WORKING WITH DELAYS)

SENT: [23:26:23.476] Machine 102 → 100: 0x09 0x20 0x21 0x13 0x00 0x13...
RECEIVED: [23:26:24.150] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 674ms)

SENT: [23:26:24.305] Machine 102 → 100: 0x09 0x29 0x00 0x66
RECEIVED: [23:26:24.634] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 329ms)

SENT: [23:26:24.511] Machine 102 → 100: 0x09 0x20 0x21 0x13... (RETRANSMISSION)
RECEIVED: [23:26:25.313] Machine 100: Same content
STATUS: 🔄 RETRANSMISSION/RECEIVED (Delay: 802ms)

SENT: [23:26:25.610] Machine 102 → 100: 0x09 0x20 0x21 0x13... (RETRANSMISSION)
RECEIVED: [23:26:26.249] Machine 100: Same content
STATUS: 🔄 RETRANSMISSION/RECEIVED (Delay: 639ms)

Complex Data Exchange - LONG FRAMES ONLY (>4 bytes)

SENT: [23:26:25.859] Machine 102 → 100: 0x09 0x42 0x21 0x13 0x00 0x03... (16 bytes)
RECEIVED: [23:26:26.913] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 1054ms)

SENT: [23:26:25.968] Machine 102 → 100: Multi-buffer 0x09 0x44 0x21 0x13... (40+ bytes)
RECEIVED: [23:26:28.624] Machine 100: Same content  
STATUS: ✅ RECEIVED (Delay: 2656ms)

SENT: [23:26:31.444] Machine 102 → 100: 0x09 0x86 0x21 0x13 0x00 0x03... (16 bytes)
RECEIVED: [23:26:38.856] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 7412ms) ⚠️ LONG FRAME HIGH LATENCY

SENT: [23:26:31.575] Machine 102 → 100: Multi-buffer 0x09 0x88 0x21 0x13... (40+ bytes)  
RECEIVED: [23:26:40.568] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 8993ms) ⚠️ LONG FRAME EXTREME LATENCY

Note: Short 4-byte frames ignored per user request. Analysis focuses on long data frames only.

Recovery Phase Responses (EXTREME DELAYS)

SENT: [23:26:31.444] Machine 102 → 100: 0x09 0x86 0x21 0x13...
RECEIVED: [23:26:38.856] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 7412ms) ⚠️ EXTREME LATENCY

SENT: [23:26:31.575] Machine 102 → 100: Multi-buffer 0x09 0x88...
RECEIVED: [23:26:40.568] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 8993ms) ⚠️ EXTREME LATENCY

SENT: [23:26:32.363] Machine 102 → 100: 0x09 0x89 0x00 0x66
RECEIVED: [23:26:43.505] Machine 100: Same content  
STATUS: ✅ RECEIVED (Delay: 11142ms) ⚠️ EXTREME LATENCY

SENT: [23:26:36.327] Machine 102 → 100: 0x01 0x3F 0x00 0x66 (Reset response)
RECEIVED: [23:26:53.033] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 16706ms) ⚠️ MASSIVE LATENCY

SENT: [23:26:40.295] Machine 102 → 100: 0x01 0x73 0x00 0x66
RECEIVED: [23:26:53.191] Machine 100: Same content
STATUS: ✅ RECEIVED (Delay: 12896ms) ⚠️ MASSIVE LATENCY

Summary Statistics & Analysis

Machine 100 → 102 Direction

  • Success Rate: ~60% of frames received
  • Average Delay (Successful): 1,200ms
  • Major Issues:
    • Initial handshake frames completely lost
    • 15+ consecutive reset frames lost during CRC error
    • Multiple retransmissions needed for long frames
    • Recovery successful with shorter frames

Machine 102 → 100 Direction

  • Success Rate: ~85% of frames received
  • Average Delay: 6,000ms (5x worse than opposite direction)
  • Major Issues:
    • Progressively increasing latency (329ms → 16,700ms)
    • No frame losses, but extreme buffering delays
    • Frames arriving many seconds after transmission

Critical Findings

  1. Asymmetric Performance: 102→100 direction has much higher latency but better delivery
  2. Progressive Degradation: Latency increases dramatically over time
  3. Retransmission Patterns: Same frames sent 2-4 times before success
  4. CRC Recovery: Both directions eventually recover from CRC error
  5. Buffer Management Issues: Suggests receive buffer overflow or processing delays

Key Findings from Long Frame Analysis (>4 bytes only)

Multi-Buffer Frame Performance Degradation

Pattern observed: Long multi-buffer frames show progressive performance degradation:

  1. Early multi-buffer frames (23:26:25-28): 2.6s delays (manageable)
  2. Later multi-buffer frames (23:26:31-40): 8.9s delays (severe)
  3. Multiple retransmissions: Same complex frame received 4-5 times over several seconds

Retransmission Evidence for Long Frames

Frame 0x09 0x44 0x21 0x13... (52 bytes) received multiple times: - [23:26:28.624] - First reception - [23:26:31.084] - Duplicate (2.46s later) - [23:26:33.778] - Duplicate (2.69s later)
- [23:26:36.164] - Duplicate (2.39s later)

Frame 0x09 0x88 0x21 0x13... (52 bytes) received multiple times: - [23:26:40.568] - First reception - [23:26:43.218] - Duplicate (2.65s later) - [23:26:46.570] - Duplicate (3.35s later) - [23:26:49.642] - Duplicate (3.07s later) - [23:26:52.728] - Duplicate (3.09s later)

Root Cause Analysis

The issue is specifically with long/complex frames:

  1. Short frames (4 bytes): Work normally with reasonable delays
  2. Medium frames (16 bytes): Show moderate delays (1-2s)
  3. Large multi-buffer frames (40-52 bytes): Show severe delays (8-9s) and multiple duplicates

Root Cause: Machine 100's receiver has processing bottleneck for large frames, causing: - Long processing delays for complex multi-buffer frames - Frame duplicates due to ACK timeouts - Progressive degradation as buffer queues build up - Eventually leads to CRC errors and communication breakdown

The bottleneck is in complex frame processing, not basic HDLC functionality. Small frames work fine, but large X.25 data packets overwhelm the receiver's processing capacity.