This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

RST message for program request

0

Hi, I;m Using program where it Requests data from a remote server and it gives data. (see Link)

I have written a Custom Program to above remote server where it sends request but doesn't get data . It send a RST and drops the session. (see Link)

Please let me know what is the issue (WireShark Logs are attached in the Links)

asked 05 Mar '13, 03:46

Irsh's gravatar image

Irsh
1222
accept rate: 0%


2 Answers:

0

In your second (faulty) capture the client sends one packet of data to the server and the server sends a FIN at frame 438 approx 7 seconds after the client data indicating it's closing the connection. All the client can do now is close the connection from its side and open a new one. The client attempting to send further data after the FIN (frame frame 440) will cause the server to send the RST as it's not interested.

Looking at your good capture the client data sent to the server seems to be a little different from the bad capture, and the client sends two items of data (frames 775, 789) before the server responds with data (frame 790).

So, your client stack needs to behave properly on receipt of a FIN and the client application needs to send the correct data to the server.

answered 05 Mar '13, 05:00

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

0

Please let me know what is the issue

If I compare the two connections I see this:

In W2.pcapng (session that gets closed quickly):

  • the client sends data in frame 314
  • the server ACKs that data
  • Then there is no communication for 6.9 seconds from the client
  • The server closes the connection with a FIN
  • The rest is 'standard' TCP connection tear down

As there is no such (large) time gap in W1.pcapng, I guess the server application closes the connection as it runs into an application specific timeout. Please check, why your client application stops sending data after the first chunk of data.

Regards
Kurt

answered 05 Mar '13, 11:10

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%