Looking to confirm which side of the wire is killing a connection between two servers. My suspicion is that 4.49.90.20 is closing down the connection with sending a FIN ACK. Does that look correct? See three attempts:
Attempt #1: https://imgur.com/a/zkVTuPZ Attempt #2: https://imgur.com/a/kcWAfbi Attempt #3: https://imgur.com/a/F3gLhXM
Yes - that's correct.
It might be easier to look at if you apply a Conversation Filter->TCP to the SYN packet at the beginning of each example. There a mix of port numbers in the images from different connections.
Looks like from the packet timing that the capture was done on 10.220.100.103.
About 120-160 uSec after receiving the FIN, ACK from 4.49.90.20 it responds with a RST, ACK.
Thanks for confirming. Figured it was a 4.49 closing the connection because it was sent before the RST, ACK from 10.220
Asked: 2020-02-18 19:38:34 +0000
Seen: 6,582 times
Last updated: Feb 18 '20
