I'm developing an Windows application that performs NAT between a virtual TAP interface and a physical Ethernet interface (with the purpose of achieving load balancing), using WinPcap. The test setup looks something like this:
I ran the test on two machines with Windows 7 64-bit, and on one of them everything works as expected, but on the other one, after SYN-ACK is received Windows sends a RST, and I don't understand why.
Here is a Wireshark capture file recorded on the physical interface. The test consist in running a web browser and try access a website. Because the default gateway is set on the TAP interface, all traffic goes through it. So this is what happens:
Initially I thought that the Windows firewall might be the one breaking the connection, but the problem doesn't go away even if I disable the firewall. Besides, I installed the same firewall on the machine that didn't have problems before and it stayed that way, everything worked as expected.
Who is sending that RST on the physical interface? How could I find out?
asked 01 Feb '14, 07:40
The usual reason for a Reset being sent is either that the incoming packets were in some way catastrophically bad/damaged (which doesn't seem to be the case here), or that the application holding the port has released it in the meantime. That results in the stack receiving a packet for a closed port and answering with a reset.
You could monitor your port state table (via netstat or Sysinternals tools like TCPView and Process Viewer) to check if your application is closing the port. Microsoft NetMon can also help with that I guess, but I don't have much experience with it.
If this would be my application I'd try to add debug messages for the component that opens and closes the ports to see when that happens, and add additional exception handlers to see if errors are thrown that could explain the socket closing.
answered 01 Feb '14, 08:01