I'm Facing huge number of TCP Reset Errors at my network. I am not in depth familiar with TCP and its behavior so i've attached a screenshot of packet capture. I want you to analyze it and tell me what you guys observe any abnormalities that could lead to any abnormal behavior.
The Problem is our web server getting 6000-10000 hits per seconds, yes it is that high. and around 20000 connection goes to tcp Time-wait state right now. So problems we are facing is Client getting RTO at number of requests (is should be responded under max 3 seconds), we are re-transmitting numerous number of packets and this RESET we are getting from client. although our bandwidths are ideal for this kind of traffic so there is no problem.
Here is the packet trace ! At first i want to cut down the RESETs.
Please help guys, i need to solve it very soon. if you need anymore information i'm ready to share it ..
asked 20 Nov '15, 05:42
edited 20 Nov '15, 05:43
From the screenshot alone it seems that the http server assumes that the tcp connection has been already established from the same source socket before, but not properly closed yet, and so it sends only ACK to the received SYN but not its own SYN.
For deeper analysis, you'd have to post .pcap (or .pcapng) capture files from both the http server side and from a client PC accessing the web taken simultaneously for some time & including occurrence of the issue for that client. As your artwork at the picture suggests that you are concerned about privacy, you may want to anonymize the captures using TraceWrangler before handing them out.
Or read this answer on another site and take the measures suggested there.
answered 20 Nov '15, 06:20
edited 20 Nov '15, 07:00