We have a billing package that uses MSSQL as it's backend. On a physical machine, there are no issues with the software. In a VM on my system, the software will remain connected to the SQL server (looks like through keep-alives). In a wireshark trace, I can see the keep alive packets and the ACK packets back. Eventually, it looks like the server sends RST packets to the client and that is what breaks the connection and causes the software to stop working (gives a bunch of errors and crashes). What I am trying to determine is why is only this VM affected and if it is software (VMWare, the network driver, etc) or is it my host (no issues running anything on the host). If I can upload the capture somewhere, I would be happy to provide. Thanks for any help that can be offered.
asked 22 Sep '16, 12:38
Well, the teardown packet (via RST) is coming from the server, so it's not the physical or virtual client that aborts the connection. The RST looks to me like a connection abort (RST is sometimes also used as a "normal" shutdown of a connection) - the question is, what did the client do to annoy the server that much?
What is odd is how frequently the client uses Keep-Alives - one per 30 seconds is quite normal, but you see that it often fires a series of packets in a few microseconds (especially right before the RSTs).
This is what I would do:
Also, try to capture with a dedicated capture device/laptop, and NOT on the end system (client or server). Here's why: https://blog.packet-foo.com/2014/05/the-drawbacks-of-local-packet-captures/
answered 25 Sep '16, 05:56
edited 25 Sep '16, 05:56