 | 1 | initial version |
Wireshark tells you what has happened, but rarely why it has happened. So you have seen that the client initiates the session by sending SYN; the next step should be to run Wireshark or tcpdump on the server to see whether the SYN packet has arrived there. If yes, there is a firewall on the server itself or the application (http server) either does not listen at all or it has some internal whitelist or blacklist which doesn't accept requests from the IP address of the client, or there may be a routing problem as the server may lack a route for the client address, so it may send it out using the default route which cannot deliver the response to the client, or nowhere at all if none of the existing routes on the server matches the IP address of the client.
If the SYN doesn't reach the server, there is some firewall or a plain dysfunction somewhere between the client and the server.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
