 | 1 | initial version |
Working on the little information shown in the text (a capture file is so much easier to work with), in the first exchange it seems that the RTU is failing to acknowledge transmissions from the server and so the server gives up and closes the connections with the RST.
In the 2nd exchange, the server is again sending retransmissions, but this time the RTU does respond and so the TCP session can continue.
This is basic TCP retransmission handling. The missing ACK's from the RTU could be dropped anywhere on the path from the RTU to the server, including either endpoint, so you'll have to capture at various points to determine the culprit.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
