Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a very weird problem with few of my servers. It seems that users on these servers, whenever they download from them, either via FTP (proftpd) or HTTP (apache2), big files (over 1GB), the download connection is dropped exactly when they reach 1GB of downloaded data.

The problem is not random, it happens every time, with all accounts, and exactly around the 1GB mark. I cannot figure out what can cause this.

Servers are running Ubuntu Linux Oneiric Ocelot

share|improve this question
Can you clarify how it's dropping - maybe check what the drop looks like with Wireshark or tcpdump? Is there a firewall of any kind in front of the servers? – Shane Madden Apr 23 '12 at 19:55
Just to clarify, i mean that the connection closes (resets) completely. – QuArK Apr 23 '12 at 20:24
there is an iptables firewall, that is only used however to mark packets for qos, it does not block any ports – QuArK Apr 23 '12 at 20:26
this is what someone receives in an ftp client: GnuTLS error -37: Rehandshake was requested by the peer. Could not read from transfer socket: ECONNABORTED - Connection aborted – QuArK Apr 23 '12 at 20:38
Once it get disconnected , can you start it right of the bet ? Also can you try force active mode . – Chakri Apr 23 '12 at 21:47

I have downloaded files much larger than 1 GB (>100 GB even) through ftp, ssh, http and never encountered such a problem in such a consistent manner. But have observed and have been troubleshooting the occasional suspicious tcp-rst packets in other situations. A tcp-rst should not happen in a normal situation, it's almost always an abnormal event that deserves some healthy suspicion.

The fact it's so consistent and the connection is reset as opposed to properly closed is an indication something fishy is going on in my opinion. Firewalls and routers (badly configured ones, or just broken) can be doing that kinda thing. You could run tcpdump whilst such a download is happening and study the output.

My guess is that your ISP may be causing this, unwillingly perhaps due to a broken router or firewall.

At times I have been trying to find out about some mysterious tcp resets myself and used tcpdump for this:

I'd say, around the 980 MB mark, tcpdump everything to a file:

tcpdump -w name.dump -i any -nnvvXSs 65535 tcp port XXX

Then use tcpdump to find the reset packet(s):

tcpdump -nnvvXSs 65535 -r name.dump 'tcp[tcpflags] & tcp-rst != 0 and tcp[tcpflags] & tcp-ack != 0' and tcp port XXX

Then once again use tcpdump and grep to look around the timestamp for anything happening that might give a clue. The -A and -B options will output 200 lines before and after the grepped line.

tcpdump -nnvvXSs 65535 -r name.dump | grep -A 200 -B 200 "timestamp of tcp-rst packet"

Ar the servers where this happens using a different ISP? Or a separate router or firewall? Can you verify this does not happen on other servers that use the same ISP, router and firewall?

share|improve this answer

Check the firewall. In some cases, the protocol timeout is the problem....

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.