Ask Your Question

Application Hangs, Need help with packet Analysis

asked 2021-08-10 12:15:22 +0000

updated 2021-08-10 12:50:49 +0000

grahamb gravatar image


I am troubleshooting an issue with an POS\Restaurant application that is hanging and has slow performance. Vendor had me send the a packet capture from one of the terminals. They are saying it looks like the firewall is causing the disconnects with the hosted system, but for troubleshooting we have firewall wide open. Can someone take a look at the following stream and let me know if it looks like the firewall would be causing an issue? To me, it looks like the terminal ( is sending the RST after the communication was ended with a FIN packet and the server tried to send Encrypted Alert. I'm just not the greatest at Analysis.

 1.    TCP 66  61398 → 443 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256
 2.    TCP 66  61398 → 443 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256
 3.    TCP 54  61398 → 443 [ACK] Seq=1 Ack=1 Win=66048 Len=0
 4.    TLSv1.2 426 Client Hello
 5.   TCP 60  443 → 61398 [ACK] Seq=1 Ack=373 Win=15872 Len=0
 6.   TLSv1.2 163 Server Hello, Change Cipher Spec, Encrypted Handshake
 7.    TLSv1.2 575 Change Cipher Spec, Encrypted Handshake Message
 8.   TCP 60  443 → 61398 [ACK] Seq=110 Ack=894 Win=16896 Len=0
 9.    TLSv1.2 464 Application Data
 10.   TCP 60  443 → 61398 [ACK] Seq=110 Ack=1304 Win=17920 Len=0
 11.   TLSv1.2 436 Application Data
 12.   TLSv1.2 612 Application Data
 13.    TCP 54  61398 → 443 [ACK] Seq=1304 Ack=1050 Win=65024 Len=0
 14.    TCP 54  61398 → 443 [FIN, ACK] Seq=1304 Ack=1050 Win=65024 Len=0
 15.   TLSv1.2 85  Encrypted Alert
 16.    TCP 54  61398 → 443 [RST, ACK] Seq=1305 Ack=1081 Win=0 Len=0
 17.   TCP 60  443 → 61398 [FIN, ACK] Seq=1081 Ack=1305 Win=17920 Len=0

Thanks in advance!

edit retag flag offensive close merge delete


Without the frame times it's a little difficult to be sure, but it certainly seems as though it's the client initiating the connection close in frame 14.

Where was the capture made, client, server or somewhere in between?

grahamb gravatar imagegrahamb ( 2021-08-10 12:52:25 +0000 )edit

The capture was made on the client. That's is what it seems like to me as well. Thank you for responding.

jjosh823 gravatar imagejjosh823 ( 2021-08-10 13:47:23 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2021-08-10 14:13:21 +0000

hugo.vanderkooij gravatar image

In a TCP session toy will see RST packets if you try to send anything else when the first FIN is seen.

But if you only see the client end you may see what the firewall is enforcing instead of what the server is doing. So the best thing to do is do a capture at least on the client and the server and compare notes.

edit flag offensive delete link more


Thank you! It ended up being a device called a COMBOX that acts as an unmanaged switch to share the ethernet connection with a credit card encoder. Once we removed that device and connected a standard 5 port unmanaged switch the connection was no longer resetting.

jjosh823 gravatar imagejjosh823 ( 2021-08-12 12:10:06 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-08-10 11:58:44 +0000

Seen: 301 times

Last updated: Aug 10 '21