Web server works but not proprietary software with IP address.

asked 2024-02-09 14:10:52 +0000

fivecent
1 ●1

updated 2024-02-09 15:23:50 +0000

Chuckc
3023 ●6 ●611 ●20

Below is host filter by problem IP. Is there anything practical from this filter that could be done to determine solution? The proprietary software gives a "unable to communicate message" in user interface.

Here is webserver working ok lines 60...66:

60  11.448615   172.17.1.36 192.168.26.187  TCP 1480    80 → 54534 [PSH, ACK] Seq=5138 Ack=311 Win=10000 Len=1426 [TCP segment of a reassembled PDU]
61  11.451812   172.17.1.36 192.168.26.187  HTTP    423 HTTP/1.1 200 OK  (text/html)
62  11.451844   192.168.26.187  172.17.1.36 TCP 54  54534 → 80 [ACK] Seq=311 Ack=6933 Win=131328 Len=0
63  12.972737   192.168.26.187  172.17.1.36 TCP 54  54534 → 80 [FIN, ACK] Seq=311 Ack=6933 Win=131328 Len=0
64  12.980260   172.17.1.36 192.168.26.187  TCP 54  80 → 54534 [ACK] Seq=6933 Ack=312 Win=10000 Len=0
65  12.980260   172.17.1.36 192.168.26.187  TCP 54  80 → 54534 [FIN, ACK] Seq=6933 Ack=312 Win=10000 Len=0
66  12.980571   192.168.26.187  172.17.1.36 TCP 54  54534 → 80 [ACK] Seq=312 Ack=6934 Win=131328 Len=0

Here is opening proprietary software lines 67...75:

67  33.029888   192.168.26.187  172.17.1.36 TCP 66  58831 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
68  34.029683   192.168.26.187  172.17.1.36 TCP 66  [TCP Retransmission] 58831 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
69  36.030149   192.168.26.187  172.17.1.36 TCP 66  [TCP Retransmission] 58831 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
70  40.030071   192.168.26.187  172.17.1.36 TCP 66  [TCP Retransmission] 58831 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
71  48.030306   192.168.26.187  172.17.1.36 TCP 66  [TCP Retransmission] 58831 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
72  72.021803   192.168.26.187  172.17.1.36 TCP 66  50882 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
73  73.021924   192.168.26.187  172.17.1.36 TCP 66  [TCP Retransmission] 50882 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
74  75.021372   192.168.26.187  172.17.1.36 TCP 66  [TCP Retransmission] 50882 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
75  79.022032   192.168.26.187  172.17.1.36 TCP 66  [TCP Retransmission] 50882 → 44818 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM

edit retag flag offensive close merge delete

Comments

(IM(not so)HO this would be easier to read if sorted in ascending order)

In frames 1-5 you can see the doubling timeout between attempts - 1 sec, 2 sec, 4 sec, 8 sec.

RFC-6298: Computing TCP's Retransmission Timer

Chuckc ( 2024-02-09 15:05:33 +0000 )edit

Was there a redirect to port 80 in the working section?
The "proprietary software" is trying to connect to port 44818.

Is there a firewall in between or on the server?

Chuckc ( 2024-02-09 15:26:12 +0000 )edit

From a remarkably similar physical connection here is filter to another device that is functioning ok(port 44818 all good). If firewall were to exist it would exist for both devices.

1   0.000000    192.168.26.187  172.17.1.38 CIP 100 Port - Get Attributes All
2   0.004783    172.17.1.38 192.168.26.187  TCP 54  44818 → 50626 [ACK] Seq=1 Ack=47 Win=8146 Len=0
3   0.004783    172.17.1.38 192.168.26.187  CIP 130 Success: Port - Get Attributes All
4   0.004942    192.168.26.187  172.17.1.38 CIP 100 Port - Get Attributes All
6   0.013081    172.17.1.38 192.168.26.187  CIP 122 Success: Port - Get Attributes All
5   0.011728    172.17.1.38 192.168.26.187  TCP 54  44818 → 50626 [ACK] Seq=77 Ack=93 Win=8146 Len=0
7 ...

(more)

fivecent ( 2024-02-09 15:39:31 +0000 )edit

add a comment