Ask Your Question
0

SMB to Azure Cloud - TCP Reset

asked 2019-09-25 16:14:06 +0000

wshark_de gravatar image

updated 2019-09-25 16:16:44 +0000

Dear community,

from time to time we face TCP SYN Retransmissions and TCP Resets when trying to connect to our Windows 2012 File Server in Azure Cloud. This is a capture at our DC internet breakout. Any ideas what can cause this? RTT is normally around 30ms. No fear, it's just 14 packets.

DOWNLOAD PCAPNG

Thanks for helping.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-09-25 19:17:14 +0000

Eddi gravatar image

Hello wshark_de and welcome to ask.wireshark

It looks like the connection is suffering from a significant packet loss. The reason for the loss cannot be determined in this short trace. The problem becomes clear with a quick walk through the trace file:

  • The TCP connection starts with a SYN from 192.168.0.1
  • Please note that the first two SYNs go unanswered, only the third one get's an answer. This in itself is unusual.
  • The SYN/ACK in packet 4 arrives with 42 msec, which is within the range that you expect.
  • The client completes the 3-way handshake in packet 6 with a retransmission in packet 7. Since we are looking at SMB we can assume that these frames try to establish the SMB dialect / version number to be used for this connection.
  • Please note that the server repeats the SYN/ACK in frames 8 and 11. This indicates that the clients ACK from frame 5 was lost in transit, just like the first two SYNs were lost.
  • The client dutifully tries to retransmit the ACK to complete the handshake in packets 9 and 12. Even the 178 byte payload from frame 6 is repeated multiple times.
  • After 30 seconds the server gives up and terminates the connection with a Reset.

It should be clear, that messages from the client hardly make it to the server. Even the initial SYN requires multiple retransmissions.

Here a couple of things to check in your network:

  • Is the problem only related to your Azure server? Or are other services experiencing similar problems?
  • If only the Azure server is affected you might want to check the configuration, event log etc.
  • If it's not just the Azure server you should check for an overloaded link, bad cables, faulty network equipment and similar issues.
  • Is your firewall working ok? An exhausted NAT pool, memory problems etc. can wreak havoc on a connection.

Good luck

Eddi

edit flag offensive delete link more

Comments

Thanks, unfortunately its not not just the Azure server. Also seen to HTTP-Servers, but less often than SMB. I will check your suggestions.

wshark_de gravatar imagewshark_de ( 2019-09-25 19:29:55 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-09-25 16:14:06 +0000

Seen: 261 times

Last updated: Sep 25 '19