TCP DUP ACK -> RST Problem

asked 2023-05-14 09:18:26 +0000

byt0x
1

Hello,

I have a problem with some network traffic and I try to find the reason. It's the comunication betwen a process (IP: 212) and a Terminal-Server (IP: 206).

Often the connection breaks and we have to restart the hardware.

In wireshark I can see these "TCP DUP ACK" and "RST" Packages. Do you know a reasy why we resend these packages so often?

The target device uses a 10MBit Port. The Process on the server uses a 100Mbit card.

I think the problem is on the side of the terminal server (IP: 206) because other connections are working fine. The strange thing is, that connections to this server on other ports than TCP:2200 are working "much better".

here are images of the TCP traffic: https://ibb.co/c667Sz7 (Port: 2100 not working) https://ibb.co/2NK7ygG (Port: 2200 working bad) https://ibb.co/tK6z5pR (Port 2400 working okay)

Thank you

edit retag flag offensive close merge delete

Comments

Ouch. a mix of 10 Mbps and 100 Mbps is allready a scenario for traffic issues. I would definitly look into getting them up-to-speed. At least the 10 Mbps one.

hugo.vanderkooij ( 2023-05-15 12:49:21 +0000 )edit

add a comment

answered 2023-05-15 00:53:14 +0000

BigFatCat
31 ●2 ●88 ●4

Did the packet capture come from 206? Is there a firewall that can track network connection states?

According to Wireshark, the TCP completeness of 206 ACK is 4, as it did not detect the presence of SYN or SYN-ACK for this particular TCP stream. When device 212 gets the ACK from 206, it sends an RST reply. I believe that the RST packet was not received by 206. If 206 received the RST, it should have terminated the session.

I suggest capturing packets at 206.

If you can't find the TCP RST packet, you need to investigate what happened to it.
If you see the TCP RST packet, make sure to check all active TCP sessions on the 206 device. TCP RST should have terminated the session. It is active, that is a problem.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

TCP DUP ACK -> RST Problem

Comments

1 Answer

Your Answer

Question Tools

Stats

TCP DUP ACK -> RST Problem edit

Comments

1 Answer

Your Answer

Question Tools

Stats

TCP DUP ACK -> RST Problem