Ask Your Question
0

I have Packet captures from the Firewall and the test computer showing the server "talking" to the computer but no sending any Data.

asked 2022-04-11 20:14:41 +0000

updated 2022-04-11 20:46:11 +0000

cmaynard gravatar image

This is a capture on the firewall I can see the client computer sending SYN

1   16:11:39.836123 10.4.32.78  1a.5b.1cd.14e   TCP 66  56550 → 80 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

Then the server sending the SYN/ACK

3   16:11:39.872254 1a.5b.1cd.14e   10.4.32.78  TCP 66  80 → 56550 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1380 WS=16 SACK_PERM=1

And the server answering

5   16:11:39.872498 10.4.32.78  1a.5b.1cd.14e   TCP 54  56550 → 80 [ACK] Seq=1 Ack=1 Win=131072 Len=0

Then the client asks for a web page

7   16:11:39.872986 10.4.32.78  1a.5b.1cd.14e   HTTP    512 GET / HTTP/1.1  *(TCP Seq# 458)

Then the server sends

9   16:11:39.908842 199.58.195.147  10.4.32.78  TCP 54  80 → 56550 [ACK] Seq=1 Ack=459 Win=65520 Len=0
12  16:11:39.909529 199.58.195.147  10.4.32.78  TCP 54  80 → 56550 [FIN, ACK] Seq=1 Ack=459 Win=262144 Len=0

and the Client sends back

13  16:11:39.909758 10.4.32.78  1a.5b.1cd.14e   TCP 54  56550 → 80 [ACK] Seq=459 Ack=2 Win=131072 Len=0
14  16:11:39.910246 10.4.32.78  1a.5b.1cd.14eTCP    54  56550 → 80 [FIN, ACK] Seq=459 Ack=2 Win=131072 Len=0

Then the server sends.

16  16:11:39.944927 1a.5b.1cd.14e   10.4.32.78  TCP 54  80 → 56550 [RST] Seq=2 Win=0 Len=0

I know the site is UP and working as I can get to it on other networks. But can't figure out why I can ping it, can see two traffic to and from it, but no web page

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2022-04-12 08:30:09 +0000

hugo.vanderkooij gravatar image

I would check webserver logs. It seems the webserver waits until the request comes in and then denies the access. If you are not on a directly connected network this could also be a firewall looking into the HTTP traffic and denying access. Nothing further can be deduced from the provided information. A full inside into the packets migh show a few more things put I expect not.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

2 followers

Stats

Asked: 2022-04-11 20:14:41 +0000

Seen: 68 times

Last updated: Apr 12