Debugging a network problem

A friend of mine faced this weird problem, they have a java web application which fetches some data from a remote server and displays it on screen. the issue is that it runs only at the client office and fails to run here!

my initial suspicion was the firewall so we worked with the network admin who confirmed that request is getting passed on outside the firewall and a response is received as well.

so why in the world are we getting a connection time out?!

WireShark came to our rescue here...(WireShark is a packet analayzer)

We ran the java app in question and viewed the packets being sent and received, we set the filter to the ip address of the remoteserver so that all the unnecessary tcp packets will not overwhelm the data.

Now it turns interesting,we could see the request getting sent and the corresponding ACK from the remote server!well now what?

there is an option "expert info" in Wireshark, i switched this on to see if it helps..presto i could see SYN requests getting sent to some local ip and that machine was not responding!

now i should give some more info here, since we are accessing a remote server, the servers name is NAT`ed in the hosts file.the ip which the java app was trying to connect was the actual ip address of the remote server(not the NATed ip)

the reason why i missed this previously was due to the filter i had set to show only the records containing the NATed ip address.

So what happens is that first connection is successful but the second connection connects to the local ip address instead of the NATed ip! now the question is where is this ip coming from? the java app connects to the remote server using a domain name not the ip address!

on further examining the requests, in the first connection the remote server is sending some payload(data) to the app. on converting the hex code of this data to string i found that it contained the ip address in question.... problem found!