"Connection: Close" Header - [RST,ACK] from Client followed by [RST] from Server

asked 2021-04-01 12:13:48 +0000

ToinoBiclas gravatar image

updated 2021-04-01 14:39:36 +0000

I was doing some loadtesting to an nginx server (client was wrk (.147) and server is ngnix (.86)). By issuing netstat i was trying to find out if the tests were clear of errors.

To my surprise i notice a high number of RST so i got back to the basics and did a curl curl 'https://.86/static/0kb.bin' -H 'Connection: close'

The curl results are shown in the bellow image:


Link to the image https://www.dropbox.com/s/gxhn97ag5g7... or https://i.ibb.co/7VJPvS5/Screenshot-2...

Flow exported to txt may be found in https://www.dropbox.com/s/jkkt10rdii8...

At first this looked like an issue but https://tools.ietf.org/html/rfc5246#s... makes me doubt it since:

   each party is
   required to send a close_notify alert before closing the write side
   of the connection.  The other party MUST respond with a close_notify
   alert of its own and close down the connection immediately,
   discarding any pending writes.  It is not required for the initiator
   of the close to wait for the responding close_notify alert before
   closing the read side of the connection.

If this is of any help the client and server are Linux boxes. Could anyone with more hands-on experience than me confirm if the behaviour is normal?

edit retag flag offensive close merge delete


The capture image doesn't seem to be publicly accessible.

grahamb gravatar imagegrahamb ( 2021-04-01 13:38:05 +0000 )edit

Added the image link, don't have enough kudos to POST the image here yet

ToinoBiclas gravatar imageToinoBiclas ( 2021-04-01 14:07:39 +0000 )edit

the only state i see on the server in netstat when the test is ESTABLISHED and FIN_WAIT1 (watch -n0.1s)

ToinoBiclas gravatar imageToinoBiclas ( 2021-04-01 14:40:49 +0000 )edit