This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I put Wireshark to both client and server, and captured something I cannot understand. This wrong behavior also cause client try to reset the connection and the original socket seems dropped.

  • Client screen shot (LargePic Port-52604): client
  • Server screen shot (LargePic Port-8777): server

As you can see, everything is fine until the client sent [PSH, ACK] Seq=260... to server. For some reason(I would love to know) the server side didn't captured this log, and also the server wouldn't sent [ACK] back to client then. Due to this, the client retransport this stream for five times, after it failed, it just thought it has to send [RST] to other side. That's what I understand the behavior is.

However, another strange thing is: in server side, after 8-9 minutes it does send a [PSH, ACK] Seq=40 ... stream, it seems it's not response to the original failed stream client sent.

Please help me to analysis what's going on during this process. It seems the client can reproduce this issue once 4-5 minutes when no communication between the two sides.

Please ask me if more information needed.

asked 03 Dec '15, 18:57

JerryBian's gravatar image

JerryBian
6113
accept rate: 0%

edited 03 Dec '15, 19:00

What is between the client and the server? A piece of cable, LAN with several switches, the internet...?

(03 Dec '15, 22:30) sindy

It looks like the server has a TCP Keepalive timer of 10 minutes. This might be too long to stay in a firewall's connection table. "It seems the client can reproduce this issue once 4-5 minutes when no communication between the two sides." If this assumption is true then reducing the Keepalive interval at the server below 5 minutes should fix this...

http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/#preventingdisconnection

Regards Matthias

permanent link

answered 04 Dec '15, 00:12

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×752
×81

question asked: 03 Dec '15, 18:57

question was seen: 1,028 times

last updated: 04 Dec '15, 00:12

p​o​w​e​r​e​d by O​S​Q​A