I am working on a problem, wherein a web application is not working over VPN for some windows 7 users. For others it just works fine. After going through the trace, one thing that looks suspicious is client closing the connection with RST/ACK when server is trying to push some more data. In a working capture this never happens. Can anyone shed some light why this might be happening. Here is the trace file. https://www.cloudshark.org/captures/a093320deab9 Kind Regards. asked 19 Jun '17, 21:08  Ravneet |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
The client side first attempts to finish the connection peacefully using FIN, indicating that it itself has nothing more to say, but then it sends a RST instead of ACKing the additional data from the server which it should normally keep accepting until the server would send its own FIN.
So can we be sure that it is really the client machine itself who sends this RST packet? Is the capture taken at the server side or at the client side? Is it at all possible for you to capture at the client machine or does the VPN interface not support capturing? I'd suspect some broken security software mid-path to send the RST in the name of the client. E.g., are the VPN client versions on the "working" and "not working" machines the same?
Thank you for looking into this. The capture has been take on the client side. Infact its taken on the VPN interface itself. The VPN client version on all the working and non working machines is the same. The difference in non working and working capture is that the clients keeps on accepting data from the server while in the non working case it just finishes the connection.
Leaving the client side application itself off the question, in that case I can only think about - different Windows 7 update levels and a bug in the TCP handling in some of them, - some additional security software (firewall, antivirus) which exists at the "bad" machines and doesn't at the "good" ones.
In general, Wireshark shows you exactly what has happened but rarely why.
Yes that is what I am focussing (windows update, fw, av) on now. Thank you for your help.