Established TCP Communication terminates without any clue

asked 2023-11-15 02:09:20 +0000

I'm not able to understand what might be the reason for a lost TCP Communication over RPC between a CentOS 7 and Windows 2019 Server.

From the Wireshark(see images below) I could see that the TCP Communication is established, and RemoteCreateInstance Response is not reaching its destination.

CentOS 7 - 172.18.19.140

Windows 2019 - 172.18.33.168

See the Wireshark images: https://stackoverflow.com/questions/7...

What could be the reason for it..?

Where should I investigate ?

answered 2023-11-15 03:22:51 +0000

Jim Young
196 ●16 ●4

There appears to be a middle box somewhere between the two systems messing with some of the TCP options and perhaps dropping certain packets.

From the limited info available from the two packetlist snapshots we can see that the initial SYN sent by the client (frame 1) had a length of 76 but when received by the server (frame 576) had a length of 74. The client advertised support for SACK but the option appears to be missing when the packet arrives at the server.

The server sent its SYN/ACK packet (frame 577) advertising MSS of 1460. But when this packet was received by the client (frame 2) the MSS value has been reduced to 1300.

The server sent its RemoteCreateInstance response as frame 594 (length 1030) which was apparently never made it to the client. I would look for a middle box as the likely source for this packet loss.

edit flag offensive delete link

Comments

On top of that, the images are of different sessions (seen by the TCP port numbers and also the TCP timestamp values), so the analysis of @Jim Young might be wrong (although I do think he is on the right track).

Please provide the pcap files for us to be able to help you out, here is a tutorial

SYN-bit ( 2023-11-16 10:41:10 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Established TCP Communication terminates without any clue

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Established TCP Communication terminates without any clue edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Established TCP Communication terminates without any clue