 | 1 | initial version |
From the (very limited) data you provided, I could deduct that the PLC seems to be counting a phantom byte for each retransmission of the FIN it sends. I assume there was a FIN before with SEQ=1570 which was not captured (as can be seen with the line with "[TCP Previous segment not captured]"). It seems the server also missed that packet (lost on the network somewhere? Do you see errors on the switch port to which the PLC is connected?). Since the retransmission of the that FIN packet has a sequence number of 1571 instead of 1570 it is not processed and the session can not be properly terminated.
Can the PLC handle multiple TCP connections? If not, it is logical that the new session is rejected with a RST. If it could handle more TCP connections, maybe there were too many hanging sessions and it can't handle an extra one.
To properly troubleshoot this, you would need to analyze the traffic over a longer period of time. But for starters, I would raise a support ticket with the PLC vendor to see if this (the increasing SEQ for FIN retransmissions) is a known issue and if they already have a new firmware with a fix for it.
