TCP SYN, SYN ACK followed by RST
Hi, I need help figuring out why the client responds with a RST in this case. Packet capture can be accessed at this link: https://egnyte.egnyte.com/dl/H0fTXIoAjW
I have confirmed that it is indeed the client sending a RST. Packet capture on the client end shows that it is sending the RST. It doesn't look like a firewall or some middleman is involved.
Any help will be appreciated. Thank you!
The capture above was done at the server? Can you upload a capture from the client end?
Have you looked at the SYN-ACK when it reached the client?
Is the client a load-balancer doing health-checks?
A capture from the client end can be found here: https://egnyte.egnyte.com/dl/0LjT2UQCEl
I have looked at the SYN-ACK. Apart from a source destination mismatch between the SYN and SYN-ACK packet, I did not find anything interesting.
@SYN-bit No the client is an smb client.
Something in the middle is changing the TCP MSS from 1460 down to 1380 when it reaches the server.
The server responds with a MSS of 1380 which arrives at the client as 1380.
The MAC address difference looks like the client is sending to a VRRP address and the responses are coming back from a HP MAC address (for one of the interfaces on the default gateway?).
I'm not sure if or which of the above two would be enough for the client to send the RST.
Different MSS values are normal, so are different MAC-addresses when a First-Hop-Redundancy-Protocol is used.
From these singled out packets, it is not possible to determine the cause of the RST. But I think it is either one of the following:
A health check by some process. This is what is called a half-open health check, as the connection is not in ESTABLISHED phase when it is already reset
Mutliple connections are opened (for instance also to port 445) and this one is closed because the other connection succeeded and had precedence.
I was just about to ask what the capture criteria was :-) Is it only for port 139?
Old link here on ports 139 and 445:
http://blogs.technet.com/b/networking...
Can access on Wayback Machine:
https://web.archive.org/web/201005300...
"Starting with Windows 2000, the operating system will prefer to use port 445 for SMB instead of port 139. In this process, the client node will send two TCP Syn packets, one with a destination port of 445 and one with a destination port of 139."
I agree, the reason for closing is somehow application/socket related. and so far I was not sure about the reason. But the port probing assumption makes absolute sense to me. Great spot @SYN-bit
Yes, The SYN ACK what it was there is not belongs to the client for which it's requested. But even why the client is sent RST is the question even there is no socket connection is being established.