This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Server sending FIN,ACK after it acknowledges the ClientKeyExchange

0

There is an HTTPS put call from Client to Server. It is failing with client recieved a connection timeout.

I have taken the snoop during the analysis, I see that Client Hello and Server Hello,Certificate,certificate request,Server Hello Done phases are success. After that client sends "Certificate, Client Key Exchange" Where server acknowledges that but immediately Server sends "FIN,ACK" message. After that client sends "Certificate Verify". As connection closed earlier RST sent by server.

Could some one please help us on this that why server is sending immediate FIN,ACK message. Let me know if you require any further information on this.

asked 29 Dec '14, 11:55

vinodaug23's gravatar image

vinodaug23
11113
accept rate: 0%

edited 30 Dec '14, 01:05


One Answer:

0

Usually this kind of connection where the server accepts the handshake first and then aborts the it almost instantly points to some sort of access restriction in the application code. E.g. if you have a server that only allows clients from a certain IP range it will accept the connection and then (as soon as the application gets notified) tears it down when the IP range is not matched.

See https://blog.packet-foo.com/2014/01/tcp-server-slamming-the-door/ for more details on those kind of situations.

answered 30 Dec '14, 02:40

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%