Ask Your Question
0

Can someone please help me with the reason behind the connection reset from the destination?

asked 2024-10-10 07:27:39 +0000

Ganesh Ghogare gravatar image

updated 2024-10-10 08:40:41 +0000

grahamb gravatar image

Some traffic:

1   2024-10-08 15:49:09.886191  10.60.23.134    10.60.26.242    TCP 66  53386 → 2111 [SYN, ECE, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

2   2024-10-08 15:49:09.887934  10.60.26.242    10.60.23.134    TCP 60  2111 → 53386 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

3   2024-10-08 15:49:10.398226  10.60.23.134    10.60.26.242    TCP 66  [TCP Port numbers reused] 53386 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

4   2024-10-08 15:49:10.401021  10.60.26.242    10.60.23.134    TCP 60  2111 → 53386 [SYN, ACK] Seq=0 Ack=1 Win=1452 Len=0 MSS=1452

5   2024-10-08 15:49:10.401225  10.60.23.134    10.60.26.242    TCP 60  53386 → 2111 [ACK] Seq=1 Ack=1 Win=65340 Len=0

6   2024-10-08 15:49:52.119806  10.60.26.242    10.60.23.134    TCP 60  2111 → 53386 [FIN, ACK] Seq=1 Ack=1 Win=1452 Len=0

7   2024-10-08 15:49:52.137650  10.60.23.134    10.60.26.242    TCP 66  53395 → 2111 [SYN, ECE, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

8   2024-10-08 15:49:52.139582  10.60.26.242    10.60.23.134    TCP 60  2111 → 53395 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

9   2024-10-08 15:49:52.645196  10.60.23.134    10.60.26.242    TCP 66  [TCP Port numbers reused] 53395 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

10  2024-10-08 15:49:52.646969  10.60.26.242    10.60.23.134    TCP 60  2111 → 53395 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

11  2024-10-08 15:49:53.150541  10.60.23.134    10.60.26.242    TCP 62  [TCP Port numbers reused] 53395 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM

12  2024-10-08 15:49:53.152258  10.60.26.242    10.60.23.134    TCP 60  2111 → 53395 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

13  2024-10-08 15:49:53.158505  10.60.26.242    10.60.23.134    TCP 60  [TCP Retransmission] 2111 → 53386 [FIN, ACK] Seq=1 Ack=1 Win=1452 Len=0

14  2024-10-08 15:49:54.166198  10.60.23.134    10.60.26.242    TCP 66  53396 → 2111 [SYN, ECE, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

15  2024-10-08 15:49:54.167899  10.60.26.242    10.60.23.134    TCP 60  2111 → 53396 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

16  2024-10-08 15:49:54.202412  10.60.26.242    10.60.23.134    TCP 60  [TCP Retransmission] 2111 → 53386 [FIN, ACK] Seq=1 Ack=1 Win=1452 Len=0

17  2024-10-08 15:49:54.681159  10.60.23.134    10.60.26.242    TCP 66  [TCP ...
(more)
edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by » oldest newest most voted
0

answered 2024-10-10 08:06:41 +0000

grahamb gravatar image

From the very scarce info you have given it's likely there is no server listening on port 2111

edit flag offensive delete link more

Comments

10.60.23.134 is the windows system sending data to PLC(Programmable Logic Controller)10.60.26.242

Ganesh Ghogare gravatar imageGanesh Ghogare ( 2024-10-10 08:20:19 +0000 )edit

The RST is coming from .242, so likely no listener. You'll need to look at the device itself to see what's going on and how it's configured, a traffic capture won't tell you why that's happening.

grahamb gravatar imagegrahamb ( 2024-10-10 08:54:43 +0000 )edit

One thing I've noticed is that whenever there is a connection reset (RST), the SYN, ECE, and CWR flags are set from the source. will that be a reason the PLC reset the connection?

Whenever there is a SYN flag set with the connection PLC accepts it and ACK it

24  2024-10-08 15:49:56.707883  10.60.23.134    10.60.26.242    TCP 66  [TCP Port numbers reused] 53397 → 2111 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM.

48  2024-10-08 15:52:02.172321  10.60.26.242    10.60.23.134    TCP 60  2111 → 53397 [ACK] Seq=1 Ack=213 Win=1452 Len=0
Ganesh Ghogare gravatar imageGanesh Ghogare ( 2024-10-10 09:03:19 +0000 )edit

When the connection is initiated the other way, .242 → .134, the Windows system doesn't accept it (with a SYN, ACK) but sends an ACK and then a FIN so the connection isn't open.

Can you let us know what the PLC device is and what protocol is being used?

Does the protocol permit connections from the PLC to the Windows system?

grahamb gravatar imagegrahamb ( 2024-10-10 09:12:59 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2024-10-10 07:27:39 +0000

Seen: 44 times

Last updated: Oct 10