Hi I need your help: I've got a strange TCP problem...can you guys tell me why a RST is sent after the SYN, SYN/ACK?
Grab the whole file here: TCP_SYN_WIRESHARK.pcap asked 26 Jul '16, 12:40  pesc |
One Answer:
That usually happens if your application developer put a socket timeout value into his code that closes the socket way too quick. Or, in case of a web browser it was closed right after calling the URL, which would also cause a socket close leading to a reset. answered 26 Jul '16, 12:44  Jasper ♦♦ showing 5 of 9 show 4 more comments |
Hmm, I'm using SQUID..any idea how to adjust?
Sorry, I don't know Squid config files that good.
ok thank you! But I'm right that no TCP (SEQ missmatch, etc...) is the problem?
No, TCP sequencing looks fine
Thank you Jasper!
But the time between SYN -> SYN/ACK is just about 200ms -> that's not abnormal, right?
I have a delta of about 131 milliseconds, which ain't good but also not uncommon for remote sites. Where do you see 200ms?
Yeah, I've just rounded up :) You're right, its 131 ms...could it also be a kernel issue?
Never seen a kernel do that on its own. It's usually an application socket shutting down which forces the kernel to send the reset packet.