This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Client stream seems not arrive at server side

0

I put Wireshark to both client and server, and captured something I cannot understand. This wrong behavior also cause client try to reset the connection and the original socket seems dropped.

  • Client screen shot (LargePic Port-52604): client
  • Server screen shot (LargePic Port-8777): server

As you can see, everything is fine until the client sent [PSH, ACK] Seq=260... to server. For some reason(I would love to know) the server side didn't captured this log, and also the server wouldn't sent [ACK] back to client then. Due to this, the client retransport this stream for five times, after it failed, it just thought it has to send [RST] to other side. That's what I understand the behavior is.

However, another strange thing is: in server side, after 8-9 minutes it does send a [PSH, ACK] Seq=40 ... stream, it seems it's not response to the original failed stream client sent.

Please help me to analysis what's going on during this process. It seems the client can reproduce this issue once 4-5 minutes when no communication between the two sides.

Please ask me if more information needed.

asked 03 Dec '15, 18:57

JerryBian's gravatar image

JerryBian
6113
accept rate: 0%

edited 03 Dec '15, 19:00

What is between the client and the server? A piece of cable, LAN with several switches, the internet...?

(03 Dec '15, 22:30) sindy

One Answer:

0

It looks like the server has a TCP Keepalive timer of 10 minutes. This might be too long to stay in a firewall's connection table. "It seems the client can reproduce this issue once 4-5 minutes when no communication between the two sides." If this assumption is true then reducing the Keepalive interval at the server below 5 minutes should fix this...

http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/#preventingdisconnection

Regards Matthias

answered 04 Dec '15, 00:12

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%