Ask Your Question
0

Getting fin after push

asked 2022-04-18 05:13:02 +0000

Sara5i gravatar image

updated 2022-04-18 08:40:53 +0000

grahamb gravatar image

The behavior of faulty sessions from pcap is below: 

Client —> server [SYN] 
Server —> client [SYN, ACK] 
Client __> server [ACK] 
server —> client [ACK] 
Client ___> server [ACK] 
Server —> client [PSH, ACK] tcp segment of a reassembled PDU 
Client ___> server [ACK] 
Server —-> client [ACK] 
Client ___> server [FIN, ACK] 
Server —-> client [FIN, ACK]

Client initiated many flows but all are gone to FIN after getting push packet

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by » oldest newest most voted
0

answered 2022-04-18 08:42:23 +0000

grahamb gravatar image

My guess would be something in the client application. You'll need to either dissect the traffic or obtain logs from the client app to make any further determination.

edit flag offensive delete link more

Comments

Thanks a lot for your reply. I don't have apmany p-level knowledge The client is trying to open HTTPS page from the web browser. in this case, how can the logs be obtained from a windows machine?

Sara5i gravatar imageSara5i ( 2022-04-18 12:04:17 +0000 )edit

Does the web browser show anything?

grahamb gravatar imagegrahamb ( 2022-04-18 13:19:40 +0000 )edit

The client gets connection time out error when attempting to access to login page while he was able to connect to main page

Sara5i gravatar imageSara5i ( 2022-04-18 13:43:14 +0000 )edit

You're now really needing to see the HTTPS dissection, but you might be able to determine it without that by looking at the relative timings of the encrypted requests, if the interval between the server PSH and the client FIN is considerable then it may be the client is timing out.

The client browser developer tools console might also give a view in to what's going on, although you'll need to look elsewhere for advice on using those.

grahamb gravatar imagegrahamb ( 2022-04-18 14:48:12 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2022-04-18 05:13:02 +0000

Seen: 173 times

Last updated: Apr 18 '22