ERR_CONNECTION_RESET - RST

asked 2018-01-16 21:04:25 +0000

mark.corbin gravatar image

updated 2018-01-17 14:42:13 +0000

A client of ours is using our web application that randomly comes across ERR_CONNECTION_RESET. We have asked them to monitor their network traffic and they have sent us a wireshark log. We do see behavior in this log that shows [RST] but we do not know enough about interpreting these logs to come to a conclusion. Can anyone please shed some light on these logs for us?

log file

Thanks in advance!

edit retag flag offensive close merge delete

Comments

That log file isn't in any file format that Wireshark can read. It also doesn't appear to be a text file. What software produced that file?

Guy Harris gravatar imageGuy Harris ( 2018-01-17 03:00:30 +0000 )edit

Hey Guy, sorry, it appears the text file has been corrupted in the upload (I think file size was larger than the FTP server allowed). I have zipped it and corrected the link in my post. Apologies and thank you for willing to take a look.

mark.corbin gravatar imagemark.corbin ( 2018-01-17 14:44:57 +0000 )edit

it appears the text file has been corrupted in the upload (I think file size was larger than the FTP server allowed)

Or perhaps either

1) the FTP software thought it was a text file and thought it had to "convert" between Windows and UN*X line endings

or

2) the upload worked, but the server thinks it's a text file, so when I download it over HTTP that "conversion" is done.

The file is NOT a text file, it's a pcapng file, which is a binary file. The pcapng file format deliberately begins with a sequence of characters that will be damaged by the process of converting text files; this was done to detect capture files that were damaged by being transferred as text files (other parts of the file will also be damaged, so it's important to detect that damage; unfortunately, the damage is not ...(more)

Guy Harris gravatar imageGuy Harris ( 2018-01-17 20:58:20 +0000 )edit

Whatever happened, the file is now downloadable and readable in Wireshark

mark.corbin gravatar imagemark.corbin ( 2018-01-17 22:11:42 +0000 )edit