Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've ran wireshark on our app server and noticed a reset packet is commonly being received when sending data to a remote telnet server when the connection has been idle for an hour or so.

I've read that our local firewall (ASA5505) may be sending this reset packet to clean up "old" connections, and that the ASA series is commonly known for this because of it's low default timeouts. Is there any way I can prove whether or not the ASA is responsible or whether the packet is coming from some other source, e.g. running a packet sniffer on the firewall to see if the packet is ever received?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Yep. I would run Wireshark on a computer connected to the external ASA interface while simultaneously running it on the server. If the server receives a RST but the RST doesn't show up in Wireshark connected to the external interface then you know it's the firewall generating the RST. If the RST shows up in Wireshark connected to the external interface then you know the firewall isn't to blame.

share|improve this answer
2  
You might be able to achieve the same thing by running the packet capture on the ASA itself as the capture can be bound to a single interface, so setup one on the external and one on the internal interface. –  James Yale Jul 12 '11 at 15:52
    
Does the ASA have the ability to run tcpdump or some other type of capture? –  joeqwerty Jul 12 '11 at 15:54
    
Hi Joe. Thanks for coming back to me. I'm not sure what it means to have a computer on the ASA external interface - the firewall (and servers behind it) are hosted in a data center and as I understand it the external interface is simply the connection to the data centre routers for internal network/internet access..? –  James Jul 12 '11 at 15:55
1  
@Joe it actually does ... cisco.com/en/US/products/ps6120/… –  Zypher Jul 12 '11 at 15:57
    
@Zypher: Thanks much. –  joeqwerty Jul 12 '11 at 16:23
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.