These server communicate internally APPS server = 192.168.8.41 DB server = 192.168.4.125 Why certain time we notice there was RESET ? Sample port 61047 = connection reset Sample OK connection port 59155
asked 11 Aug '16, 00:40  suarez123 |
2 Answers:
Hi suarez123, Well in case you just wonder about the RST packet from the APPS server: It sends it because the session has been closed from his perspective with frame number 6. Since the other end keeps sending data after another ~12 seconds 192.168.8.41 sends out a RST and makes 192.168.4.125 aware of the (half-)closed socket. On the other hand your Apps server might just utilize a faster way of closing a session. Have a look at this: https://ask.wireshark.org/questions/13986/why-tcp-reset-sent-after-receive-finack-packet The information provided by screenshots of pcaps is often not sufficient in order to to debug an issue. Please upload your (anonymized) traces to a public place and share it with us. answered 11 Aug '16, 04:26  SimonL |
The client (192.168.8.41) closes the connection by using the FIN Bit because he is missing the RESPONSE packet from the server after the client sends the first PRE-LOGIN packet. After he had closed the connection the server sends the RESPONSE and now the clients interacts with a RST. So you can see why the server RESPONSE is delayed or you can tune the application timeout at client side. answered 15 Aug '16, 11:32  Christian_R Thank you Christia..you are the best... This issue related to application right ? not related to network level ? :) (15 Aug '16, 20:00) suarez123 To the app, server or some fw, proxy or lb. (15 Aug '16, 22:30) Christian_R |
hi,
Thank you SimonL...great.. Why the okey sample got 3 time TDS7 pre-login message ? Why the APP server send FIN ? The connection already done ? Could you compare with the port 59155 ?
Thank !!
Below is the wireshark.........
https://www.cloudshark.org/captures/b83b77fd4130