1

Trying to help someone with a situation where TCP connections get mysteriously dropped after a few minutes for no apparent reason (this happens even with non idle connections). Both client and server running linux and doing good outside of this case.

There's every reason to suspect some faulty router in between is doing it (there's some NAT involved).

How do I find which router is dropping the connection ?

Any tool like tcptraceroute but that'd keep a TCP connection open and keep probing it until it gets dropped ? (at which point we know who the culprit is)

3
  • Define "dropped". Do you mean that the connection is being closed with a FIN or RST, or that segments just stop showing up and eventually the connection is closed? Oct 17, 2014 at 15:08
  • tcpdump capture shows the connection doesn't get closed, just no packets coming in after it happens. Oct 17, 2014 at 16:08
  • Is this picture identical on both the server and the client ?
    – drookie
    Oct 18, 2014 at 5:03

1 Answer 1

2

I previously stated that tracing an established connection is impossible to do.
This, however, is wrong.

lcamtuf created the 0trace tool that allows TCP tracerouting using packets that match an established connection.
There is an improved version called intrace, and also Python version by Jon Oberheide.

The idea is to sniff for packets for a specified connection, then inject packets with matching TCP sequence numbers while increasing the TTL (just like usual traceroute does).

With several tries and some luck, you might be able to find the hop that starts to drop packets, as this hop will also drop your tracing packets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .