I have around 20 clients communicating together with a central server in the same LAN. The clients can make transaction simultaneously with the server. The server forward each transaction to external appliance in the network. Sometimes it works, sometimes my application shows a "time out" message in a client screen (randomly)
I mirrored all traffic and found TCP Retransmission after TCP Reset packets for the first TCP Sequence. I immediately thought about packet loss but all my cables/NIC are fine, and I do not see DUP ACK in the capture.
It seems that RST packets may have different significations.
I would appreciate any help. Thanks in advance.
asked 22 Jul '14, 01:08
edited 01 Aug '14, 00:49
Your clients do connect to 22.214.171.124 at port 2200. Those connections work fine, according to the data in the capture file. But then the clients do connect to the same server on ports 11007,11008,11012,11014 and 11015. Those are connection attempts that get a RESET. The client seems to either ignore the RESET, as it sends the SYN again, or the RESET does not reach the client.
To me it looks like those ports are dynamically negotiated in your application, similar to FTP, where a dynamic port is "negotiated" in the control channel on port 21.
Maybe the server did not open a socket (fast enough) for the 'announced' port (110xx) and thus the OS sends a RESET. Without an in-depth understanding of your application, it's impossible to explain why this happens.
answered 22 Jul '14, 02:22
Kurt Knochner ♦