Revision history [back]

Hi all, A linux client is experiencing slow HTTP. I found, among other things, this TCP handshake which seems odd. It's not the first handshake but one among many. The client, with IP 192.168.105.52, initiates the SYN. The server responds with SYN-ACK but then the client sends an RST. What are the potential reasons for this? At least the TSecr and TSval values match. What other things should I check for that can cause RST?

Can this handshake be analyzed in isolation? I'm not comfortable sending other HTTP traffic.

https://www.cloudshark.org/captures/7e92abd7fe83

Thanks! K

Hi all, A linux client is experiencing slow HTTP. I found, among other things, this TCP handshake which seems odd. odd (see pcap link below). It's not the first handshake but one among many. The client, with IP 192.168.105.52, initiates the SYN. The server responds with SYN-ACK but then the client sends an RST. What are the potential reasons for this? At least the TSecr and TSval values match. What other things should I check for that can cause RST?

Can this handshake be analyzed in isolation? I'm not comfortable sending other HTTP traffic.

https://www.cloudshark.org/captures/7e92abd7fe83

Thanks! K

Hi all, all,

A linux client is experiencing slow HTTP. I found, among other things, this TCP handshake which seems odd (see pcap link below). It's not the first handshake but one among many. The client, with IP 192.168.105.52, initiates the SYN. The server responds with SYN-ACK but then the client sends an RST.

What are the potential reasons for this? At least the TSecr and TSval values match. What other things should I check for that can cause RST?

Can this handshake be analyzed in isolation? I'm not comfortable sending other HTTP traffic.

https://www.cloudshark.org/captures/7e92abd7fe83

Thanks! K