TCP Reset Cisco 3850
Hello, (I would upload a pic or some files but I need 60 points I guess)
I'm having some communication issues between two PBXs. I setup a couple of laptops and captured at both ends. In going through capture I noticed something interesting. Please confirm if I'm reading this correctly and maybe help me understand what would cause this on the switch.
The source shows it’s coming from 10.181.21.6 which is the phone server on the other side of my WAN which is I believe 4 hops away from 10.182.5.2. When I look at the header it shows TTL 254 see second screenshot. This tells me this packet was only routed once. There’s no way it came from 4 hops away. So if you look at the mac address of the source you will see it’s 70:10:5C:De:75:f7 which is my core 3850 switch on that same subnet. To me the reset was produced by this SVI somehow. Maybe I’m wrong if so please explain how I’m wrong or explain how this is possible? The reverse is also true of the other capture the source of the reset shows it’s the IP of my phone server sitting on the 10.182.5.0 subnet but looking at the reset packet itself the TTL is only 254 again so to me it looks like it’s being generated from the SVI on the 3850 in my Datacenter.
You can post the capture files on a public share (Google Drive, Drop Box etc.) and then edit your question with a link to the files.