First time here? Check out the FAQ!

Ask Your Question
0

Can someone please help me with the reason behind the connection reset from the destination?
 
  
 
 
     
 
 
 
 
 
 
 
    
        
        asked Oct 10 '4  
 
 Ganesh Ghogare gravatar image  
 
 
 
 
    
        
        updated Oct 10 '4  
 
 grahamb gravatar image  
 
 
 
 
 
Some traffic:
 
1   2024-10-08 15:49:09.886191  10.60.23.134    10.60.26.242    TCP 66  53386 → 2111 [SYN, ECE, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

2   2024-10-08 15:49:09.887934  10.60.26.242    10.60.23.134    TCP 60  2111 → 53386 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

3   2024-10-08 15:49:10.398226  10.60.23.134    10.60.26.242    TCP 66  [TCP Port numbers reused] 53386 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

4   2024-10-08 15:49:10.401021  10.60.26.242    10.60.23.134    TCP 60  2111 → 53386 [SYN, ACK] Seq=0 Ack=1 Win=1452 Len=0 MSS=1452

5   2024-10-08 15:49:10.401225  10.60.23.134    10.60.26.242    TCP 60  53386 → 2111 [ACK] Seq=1 Ack=1 Win=65340 Len=0

6   2024-10-08 15:49:52.119806  10.60.26.242    10.60.23.134    TCP 60  2111 → 53386 [FIN, ACK] Seq=1 Ack=1 Win=1452 Len=0

7   2024-10-08 15:49:52.137650  10.60.23.134    10.60.26.242    TCP 66  53395 → 2111 [SYN, ECE, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

8   2024-10-08 15:49:52.139582  10.60.26.242    10.60.23.134    TCP 60  2111 → 53395 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

9   2024-10-08 15:49:52.645196  10.60.23.134    10.60.26.242    TCP 66  [TCP Port numbers reused] 53395 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

10  2024-10-08 15:49:52.646969  10.60.26.242    10.60.23.134    TCP 60  2111 → 53395 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

11  2024-10-08 15:49:53.150541  10.60.23.134    10.60.26.242    TCP 62  [TCP Port numbers reused] 53395 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM

12  2024-10-08 15:49:53.152258  10.60.26.242    10.60.23.134    TCP 60  2111 → 53395 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

13  2024-10-08 15:49:53.158505  10.60.26.242    10.60.23.134    TCP 60  [TCP Retransmission] 2111 → 53386 [FIN, ACK] Seq=1 Ack=1 Win=1452 Len=0

14  2024-10-08 15:49:54.166198  10.60.23.134    10.60.26.242    TCP 66  53396 → 2111 [SYN, ECE, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

15  2024-10-08 15:49:54.167899  10.60.26.242    10.60.23.134    TCP 60  2111 → 53396 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

16  2024-10-08 15:49:54.202412  10.60.26.242    10.60.23.134    TCP 60  [TCP Retransmission] 2111 → 53386 [FIN, ACK] Seq=1 Ack=1 Win=1452 Len=0

17  2024-10-08 15:49:54.681159  10.60.23.134    10.60.26.242    TCP 66  [TCP ...
 (more)
Preview: (hide)
 
 
 
 
          
 
add a comment
 
 
 
 
 
 1 Answer
    
 
 
                    Sort by »
                     oldest newest most voted 
 
 
 
 
 
  
 
 
 
 
0
 
 
  
 
 
 
 
 
 
 
 
    
        
        answered Oct 10 '4  
 
 grahamb gravatar image  
 
 
 
 
 
From the very scarce info you have given it's likely there is no server listening  on port 2111
 
Preview: (hide)
 
 
 
 
         
        link
        
 
Comments
10.60.23.134 is the windows system sending data to PLC(Programmable Logic Controller)10.60.26.242
Ganesh Ghogare gravatar imageGanesh Ghogare (
    
        Oct 10 '4
    )
The RST is coming from .242, so likely no listener.  You'll need to look at the device itself to see what's going on and how it's configured, a traffic capture won't tell you why that's happening.
grahamb gravatar imagegrahamb (
    
        Oct 10 '4
    )
One thing I've noticed is that whenever there is a connection reset (RST), the SYN, ECE, and CWR flags are set from the source. will that be a reason the PLC reset the connection?
Whenever there is a SYN flag set with the connection PLC accepts it and ACK it
24  2024-10-08 15:49:56.707883  10.60.23.134    10.60.26.242    TCP 66  [TCP Port numbers reused] 53397 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM.

48  2024-10-08 15:52:02.172321  10.60.26.242    10.60.23.134    TCP 60  2111 → 53397 [ACK] Seq=1 Ack=213 Win=1452 Len=0
Ganesh Ghogare gravatar imageGanesh Ghogare (
    
        Oct 10 '4
    )
When the connection is initiated the other way, .242 → .134, the Windows system doesn't accept it (with a SYN, ACK) but sends an ACK and then a FIN so the connection isn't open.



Can you let us know what the PLC device is and what protocol is being used?



Does the protocol permit connections from the PLC to the Windows system?
grahamb gravatar imagegrahamb (
    
        Oct 10 '4
    )
add a comment
 
 
 
 
  
 
 
 
 

    
        Your Answer
    

 
 Please start posting anonymously - your entry will be published after you log in or create a new account.

    

 
 
Add Answer
 
 
 
 
 
 
 
 
   
  
 
   
 
 
 
 
 
 
 
 
Question Tools
  
 

        
        
            1 follower
        
    
 
 
 subscribe to rss feed 
 
 
 
 
 
 
Stats
 

        Asked:  Oct 10 '4  
 
 
        Seen: 150 times 
 

        Last updated: Oct 10 '24