Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

TCP RESET in windows server 2016

Hi Team, Server is sending TCP reset frequently and not sure the reason. we use windows server 2016 + windows NLB and it is vmnet3 network adapter of vmware. Please find the capture logs from client machine

No. Time Delta DeltaTCPCon DeltaFrom1stFrame Source Destination Protocol TTL Seq No Next Seq No ACK No TCP Len Source Port Dest Port Identification Info 27944 2021-02-23 08:05:33.072669 1.188323000 0.000000000 0.000000000 CLIENT SERVER TCP 64 0 1 0 0 40656 (40656) https (443) 0x32c4 (12996) 40656 → https(443) [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=1497627054 TSecr=0 WS=128 27945 2021-02-23 08:05:33.073133 0.000464000 0.000464000 0.000464000 SERVER CLIENT TCP 128 0 1 1 0 https (443) 40656 (40656) 0x2791 (10129) https(443) → 40656 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1 TSval=1487099916 TSecr=1497627054 27946 2021-02-23 08:05:33.073178 0.000045000 0.000045000 0.000509000 CLIENT SERVER TCP 64 1 1 1 0 40656 (40656) https (443) 0x32c5 (12997) 40656 → https(443) [ACK] Seq=1 Ack=1 Win=29312 Len=0 TSval=1497627054 TSecr=1487099916 27947 2021-02-23 08:05:33.073951 0.000773000 0.000773000 0.001282000 CLIENT SERVER TLSv1.2 64 1 208 1 207 40656 (40656) https (443) 0x32c6 (12998) Client Hello 27948 2021-02-23 08:05:33.096190 0.022239000 0.022239000 0.023521000 SERVER CLIENT TCP 128 1 1449 208 1448 https (443) 40656 (40656) 0x2792 (10130) https(443) → 40656 [ACK] Seq=1 Ack=208 Win=2108160 Len=1448 TSval=1487099939 TSecr=1497627055 [TCP segment of a reassembled PDU] 27949 2021-02-23 08:05:33.096257 0.000067000 0.000067000 0.023588000 CLIENT SERVER TCP 64 208 208 1449 0 40656 (40656) https (443) 0x32c7 (12999) 40656 → https(443) [ACK] Seq=208 Ack=1449 Win=32128 Len=0 TSval=1497627078 TSecr=1487099939 27950 2021-02-23 08:05:33.096295 0.000038000 0.000038000 0.023626000 SERVER CLIENT TCP 128 1449 2897 208 1448 https (443) 40656 (40656) 0x2793 (10131) https(443) → 40656 [ACK] Seq=1449 Ack=208 Win=2108160 Len=1448 TSval=1487099939 TSecr=1497627055 [TCP segment of a reassembled PDU] 27951 2021-02-23 08:05:33.096306 0.000011000 0.000011000 0.023637000 CLIENT SERVER TCP 64 208 208 2897 0 40656 (40656) https (443) 0x32c8 (13000) 40656 → https(443) [ACK] Seq=208 Ack=2897 Win=35072 Len=0 TSval=1497627078 TSecr=1487099939 27952 2021-02-23 08:05:33.096308 0.000002000 0.000002000 0.023639000 SERVER CLIENT TLSv1.2 128 2897 3785 208 888 https (443) 40656 (40656) 0x2794 (10132) Server Hello, Certificate, Server Key Exchange, Server Hello Done 27953 2021-02-23 08:05:33.096315 0.000007000 0.000007000 0.023646000 CLIENT SERVER TCP 64 208 208 3785 0 40656 (40656) https (443) 0x32c9 (13001) 40656 → https(443) [ACK] Seq=208 Ack=3785 Win=37888 Len=0 TSval=1497627078 TSecr=1487099939 27954 2021-02-23 08:05:33.104173 0.007858000 0.007858000 0.031504000 CLIENT SERVER TLSv1.2 64 208 474 3785 266 40656 (40656) https (443) 0x32ca (13002) Client Key Exchange 27955 2021-02-23 08:05:33.107447 0.003274000 0.003274000 0.034778000 CLIENT SERVER TLSv1.2 64 474 480 3785 6 40656 (40656) https (443) 0x32cb (13003) Change Cipher Spec 27956 2021-02-23 08:05:33.107511 0.000064000 0.000064000 0.034842000 CLIENT SERVER TLSv1.2 64 480 525 3785 45 40656 (40656) https (443) 0x32cc (13004) Encrypted Handshake Message 27957 2021-02-23 08:05:33.107655 0.000144000 0.000144000 0.034986000 SERVER CLIENT TCP 128 3785 3785 480 0 https (443) 40656 (40656) 0x2795 (10133) https(443) → 40656 [ACK] Seq=3785 Ack=480 Win=2107904 Len=0 TSval=1487099951 TSecr=1497627085 27958 2021-02-23 08:05:33.115543 0.007888000 0.007888000 0.042874000 SERVER CLIENT TCP 128 3785 3785 525 0 https (443) 40656 (40656) 0x2796 (10134) https(443) → 40656 [RST, ACK] Seq=3785 Ack=525 Win=0 Len=0

TCP RESET in windows server 2016

Hi Team, Server is sending TCP reset frequently and not sure the reason. we use windows server 2016 + windows NLB and it is vmnet3 network adapter of vmware. Please find the capture logs from client machine

No. Time Delta DeltaTCPCon DeltaFrom1stFrame Source Destination Protocol TTL Seq No Next Seq No ACK No TCP Len Source Port Dest Port Identification Info 27944 2021-02-23 08:05:33.072669 1.188323000 0.000000000 0.000000000 CLIENT SERVER TCP 64 0 1 0 0 40656 (40656) https (443) 0x32c4 (12996) 40656 → https(443) [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=1497627054 TSecr=0 WS=128 27945 2021-02-23 08:05:33.073133 0.000464000 0.000464000 0.000464000 SERVER CLIENT TCP 128 0 1 1 0 https (443) 40656 (40656) 0x2791 (10129) https(443) → 40656 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1 TSval=1487099916 TSecr=1497627054 27946 2021-02-23 08:05:33.073178 0.000045000 0.000045000 0.000509000 CLIENT SERVER TCP 64 1 1 1 0 40656 (40656) https (443) 0x32c5 (12997) 40656 → https(443) [ACK] Seq=1 Ack=1 Win=29312 Len=0 TSval=1497627054 TSecr=1487099916 27947 2021-02-23 08:05:33.073951 0.000773000 0.000773000 0.001282000 CLIENT SERVER TLSv1.2 64 1 208 1 207 40656 (40656) https (443) 0x32c6 (12998) Client Hello 27948 2021-02-23 08:05:33.096190 0.022239000 0.022239000 0.023521000 SERVER CLIENT TCP 128 1 1449 208 1448 https (443) 40656 (40656) 0x2792 (10130) https(443) → 40656 [ACK] Seq=1 Ack=208 Win=2108160 Len=1448 TSval=1487099939 TSecr=1497627055 [TCP segment of a reassembled PDU] 27949 2021-02-23 08:05:33.096257 0.000067000 0.000067000 0.023588000 CLIENT SERVER TCP 64 208 208 1449 0 40656 (40656) https (443) 0x32c7 (12999) 40656 → https(443) [ACK] Seq=208 Ack=1449 Win=32128 Len=0 TSval=1497627078 TSecr=1487099939 27950 2021-02-23 08:05:33.096295 0.000038000 0.000038000 0.023626000 SERVER CLIENT TCP 128 1449 2897 208 1448 https (443) 40656 (40656) 0x2793 (10131) https(443) → 40656 [ACK] Seq=1449 Ack=208 Win=2108160 Len=1448 TSval=1487099939 TSecr=1497627055 [TCP segment of a reassembled PDU] 27951 2021-02-23 08:05:33.096306 0.000011000 0.000011000 0.023637000 CLIENT SERVER TCP 64 208 208 2897 0 40656 (40656) https (443) 0x32c8 (13000) 40656 → https(443) [ACK] Seq=208 Ack=2897 Win=35072 Len=0 TSval=1497627078 TSecr=1487099939 27952 2021-02-23 08:05:33.096308 0.000002000 0.000002000 0.023639000 SERVER CLIENT TLSv1.2 128 2897 3785 208 888 https (443) 40656 (40656) 0x2794 (10132) Server Hello, Certificate, Server Key Exchange, Server Hello Done 27953 2021-02-23 08:05:33.096315 0.000007000 0.000007000 0.023646000 CLIENT SERVER TCP 64 208 208 3785 0 40656 (40656) https (443) 0x32c9 (13001) 40656 → https(443) [ACK] Seq=208 Ack=3785 Win=37888 Len=0 TSval=1497627078 TSecr=1487099939 27954 2021-02-23 08:05:33.104173 0.007858000 0.007858000 0.031504000 CLIENT SERVER TLSv1.2 64 208 474 3785 266 40656 (40656) https (443) 0x32ca (13002) Client Key Exchange 27955 2021-02-23 08:05:33.107447 0.003274000 0.003274000 0.034778000 CLIENT SERVER TLSv1.2 64 474 480 3785 6 40656 (40656) https (443) 0x32cb (13003) Change Cipher Spec 27956 2021-02-23 08:05:33.107511 0.000064000 0.000064000 0.034842000 CLIENT SERVER TLSv1.2 64 480 525 3785 45 40656 (40656) https (443) 0x32cc (13004) Encrypted Handshake Message 27957 2021-02-23 08:05:33.107655 0.000144000 0.000144000 0.034986000 SERVER CLIENT TCP 128 3785 3785 480 0 https (443) 40656 (40656) 0x2795 (10133) https(443) → 40656 [ACK] Seq=3785 Ack=480 Win=2107904 Len=0 TSval=1487099951 TSecr=1497627085 27958 2021-02-23 08:05:33.115543 0.007888000 0.007888000 0.042874000 SERVER CLIENT TCP 128 3785 3785 525 0 https (443) 40656 (40656) 0x2796 (10134) https(443) → 40656 [RST, ACK] Seq=3785 Ack=525 Win=0 Len=0

TCP RESET in windows server 2016

Hi Team, Server is sending TCP reset frequently and not sure the reason. we use windows server 2016 + windows NLB and it is vmnet3 network adapter of vmware. Please find the capture logs from client machine

No. Time    Delta   DeltaTCPCon DeltaFrom1stFrame   Source  Destination Protocol    TTL Seq No  Next Seq No ACK No  TCP Len Source Port Dest Port   Identification  Info
27944   2021-02-23 08:05:33.072669  1.188323000 0.000000000 0.000000000 CLIENT  SERVER  TCP 64  0   1   0   0   40656 (40656)   https (443) 0x32c4 (12996)  40656 → https(443) [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=1497627054 TSecr=0 WS=128
27945   2021-02-23 08:05:33.073133  0.000464000 0.000464000 0.000464000 SERVER  CLIENT  TCP 128 0   1   1   0   https (443) 40656 (40656)   0x2791 (10129)  https(443) → 40656 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1 TSval=1487099916 TSecr=1497627054
27946   2021-02-23 08:05:33.073178  0.000045000 0.000045000 0.000509000 CLIENT  SERVER  TCP 64  1   1   1   0   40656 (40656)   https (443) 0x32c5 (12997)  40656 → https(443) [ACK] Seq=1 Ack=1 Win=29312 Len=0 TSval=1497627054 TSecr=1487099916
27947   2021-02-23 08:05:33.073951  0.000773000 0.000773000 0.001282000 CLIENT  SERVER  TLSv1.2 64  1   208 1   207 40656 (40656)   https (443) 0x32c6 (12998)  Client Hello
27948   2021-02-23 08:05:33.096190  0.022239000 0.022239000 0.023521000 SERVER  CLIENT  TCP 128 1   1449    208 1448    https (443) 40656 (40656)   0x2792 (10130)  https(443) → 40656 [ACK] Seq=1 Ack=208 Win=2108160 Len=1448 TSval=1487099939 TSecr=1497627055 [TCP segment of a reassembled PDU]
27949   2021-02-23 08:05:33.096257  0.000067000 0.000067000 0.023588000 CLIENT  SERVER  TCP 64  208 208 1449    0   40656 (40656)   https (443) 0x32c7 (12999)  40656 → https(443) [ACK] Seq=208 Ack=1449 Win=32128 Len=0 TSval=1497627078 TSecr=1487099939
27950   2021-02-23 08:05:33.096295  0.000038000 0.000038000 0.023626000 SERVER  CLIENT  TCP 128 1449    2897    208 1448    https (443) 40656 (40656)   0x2793 (10131)  https(443) → 40656 [ACK] Seq=1449 Ack=208 Win=2108160 Len=1448 TSval=1487099939 TSecr=1497627055 [TCP segment of a reassembled PDU]
27951   2021-02-23 08:05:33.096306  0.000011000 0.000011000 0.023637000 CLIENT  SERVER  TCP 64  208 208 2897    0   40656 (40656)   https (443) 0x32c8 (13000)  40656 → https(443) [ACK] Seq=208 Ack=2897 Win=35072 Len=0 TSval=1497627078 TSecr=1487099939
27952   2021-02-23 08:05:33.096308  0.000002000 0.000002000 0.023639000 SERVER  CLIENT  TLSv1.2 128 2897    3785    208 888 https (443) 40656 (40656)   0x2794 (10132)  Server Hello, Certificate, Server Key Exchange, Server Hello Done
27953   2021-02-23 08:05:33.096315  0.000007000 0.000007000 0.023646000 CLIENT  SERVER  TCP 64  208 208 3785    0   40656 (40656)   https (443) 0x32c9 (13001)  40656 → https(443) [ACK] Seq=208 Ack=3785 Win=37888 Len=0 TSval=1497627078 TSecr=1487099939
27954   2021-02-23 08:05:33.104173  0.007858000 0.007858000 0.031504000 CLIENT  SERVER  TLSv1.2 64  208 474 3785    266 40656 (40656)   https (443) 0x32ca (13002)  Client Key Exchange
27955   2021-02-23 08:05:33.107447  0.003274000 0.003274000 0.034778000 CLIENT  SERVER  TLSv1.2 64  474 480 3785    6   40656 (40656)   https (443) 0x32cb (13003)  Change Cipher Spec
27956   2021-02-23 08:05:33.107511  0.000064000 0.000064000 0.034842000 CLIENT  SERVER  TLSv1.2 64  480 525 3785    45  40656 (40656)   https (443) 0x32cc (13004)  Encrypted Handshake Message
27957   2021-02-23 08:05:33.107655  0.000144000 0.000144000 0.034986000 SERVER  CLIENT  TCP 128 3785    3785    480 0   https (443) 40656 (40656)   0x2795 (10133)  https(443) → 40656 [ACK] Seq=3785 Ack=480 Win=2107904 Len=0 TSval=1487099951 TSecr=1497627085
27958   2021-02-23 08:05:33.115543  0.007888000 0.007888000 0.042874000 SERVER  CLIENT  TCP 128 3785    3785    525 0   https (443) 40656 (40656)   0x2796 (10134)  https(443) → 40656 [RST, ACK] Seq=3785 Ack=525 Win=0 Len=0 

Len=0