This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Understanding a Packet Capture

0

I am new to Wireshark and have created a packet capture between two servers, one within the LAN and the other in our DMZ. The program tells me it uses port 8004, which I have opened up on our firewall. From what I see in the catpure, it looks like it's using 8004 but routing it to another port? Any help reading this would be great ... Here is a portion of my capture.

192.168.1.23    192.168.3.10    TCP 60177 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60177 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60177 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP 8004 > 60177 [RST, ACK] Seq=1 Ack=4006900096 Win=0 Len=0    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60177 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60177 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60177 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP [TCP ACKed lost segment] 8004 > 60177 [RST, ACK] Seq=1 Ack=660724035 Win=0 Len=0    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60177 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60177 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60177 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP [TCP ACKed lost segment] 8004 > 60177 [RST, ACK] Seq=1 Ack=587607840 Win=0 Len=0    
192.168.1.23    192.168.3.10    TCP 60178 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60178 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60178 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP [TCP ACKed lost segment] 8004 > 60178 [RST, ACK] Seq=1 Ack=1954781099 Win=0 Len=0    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60178 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60178 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60178 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP [TCP ACKed lost segment] 8004 > 60178 [RST, ACK] Seq=1 Ack=939193442 Win=0 Len=0    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60178 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60178 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60178 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP [TCP ACKed lost segment] 8004 > 60178 [RST, ACK] Seq=1 Ack=1625215588 Win=0 Len=0    
192.168.1.23    192.168.3.10    TCP 60179 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60179 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60179 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP 8004 > 60179 [RST, ACK] Seq=1 Ack=2224311254 Win=0 Len=0    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60179 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.1.23    192.168.3.10    TCP [TCP Port numbers reused] 60179 > 8004 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1    
192.168.3.10    192.168.1.23    TCP 8004 > 60179 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0    
192.168.3.10    192.168.1.23    TCP [TCP ACKed lost segment] 8004 > 60179 [RST, ACK] Seq=1 Ack=45320348 Win=0 Len=0

asked 25 Jan '11, 07:39

HSD's gravatar image

HSD
6●1●1●2
accept rate: 0%

edited 14 May '13, 01:33

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206

I'm getting the same kind of error except; in my case a port which is closed is quickly (5 seconds later) being reused.

Example: TCP-PORT=545454 -> do a TCP session on port=545454 SYN/SYN-ACK/SYN/SYN-ACK/DATA/FIN-ACK/ACK/FIN-ACK/ACK wait 5 seconds -> do a TCP session on port=545454 SYN SEQNUM=0 -> ACK SEQNUM=0 ACKNUM=1507571667

This causes a RST to be triggered. There seems to be a link as if the second TCP session is being "fudged" with a bad ACKNUM.

(27 Oct '11, 08:05) grandman

You can't reuse a connection tuple (src_ip,src_port, dst_ip, dst_port, protocol) within 5 seconds. The server normally waits for 2xMSL seconds before tearing down a connection. If any new connection request comes on the same tuple, it will send out a RST packet (There are exceptions though, see TIME-WAIT assassination)

(14 May '13, 00:38) xkgt

3 Answers:

0

The server is on port 8004. The client also has a port. So if the communication is going from client to server, the first example is:

60177 > 8004 (TCP Source Port 60177, TCP Destination 8004)

When the server responds to the clinet

8004 > 60177 (TCP Source Port 8004, TCP Destination 60177)

Later on you will see other source/destination combination for subsequent TCP sessions.

answered 25 Jan '11, 07:47

Paul%20Stewart's gravatar image

Paul Stewart
301●8
accept rate: 6%

1

This looks like a typical case of "client wants to talk to a server port that isn't listened on or blocked by a firewall reject rule". Your client repeatedly sends a SYN to port 8004 and gets a RST back, which means that the server or a device in between refused the connection.

Things to check:

  1. On the server: is there a program/service running that is offering services on port 8004? You can check using the netstat command on the command line if the port is listened on.
  2. If there is a service running you might have a problem with a firewall or other ACL device. Check your network path between client and server for such devices and their rule sets.

Hope this helps.

answered 25 Jan '11, 09:21

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

0

There seems to be another active TCB with src port 60177 and dst port 8004, so wireshark is pumping message that TCP ports are reused. It is not easy to identify the cause unless you look at the whole packet capture since beginning of time.

answered 17 Oct '12, 19:03

xkgt's gravatar image

xkgt
6●3●3●6
accept rate: 0%