Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Topology: Client ----- Intermediate Device ----- Server

Client: win7

Intermediate Device: unknown

Server: CentOS 5.8

The problem occurs when the client and server are trying to establish a SSL connection. It happens to one specific port, 2000. I haven't been able to replicate the problem with other port numbers.

I captured packets on both client and server. After the TCP handshake, from the client's perspective, it's not receiving ACKs for its previously sent packets so it kept re-sending them. On the server side, however, it did receive those packets and sent ACK packets.

The weird thing is, after the server sent those ACKs, it received a [RST, ACK] packet, from the intermediate device, for every packet it sent.

What could be the cause?

share|improve this question
    
Are they on the same wire? (i.e: no other devices in between such as a firewall, router, ...) –  m1ke Jun 26 '12 at 8:41
    
@m1ke No they are not on the same wire. The server is located in an IDC, and the client is my own desktop using ADSL(or something similar) –  infgeoax Jun 26 '12 at 8:47
    
Do you see any of the TLS handshake (Client Hello at least)? –  Bruno Jun 26 '12 at 10:22
add comment

1 Answer 1

up vote 1 down vote accepted

If this happens after the SSL connection has been negotiated, it is possible that the intermediate device considers encrypted traffic on port 2000 as a potential security threat (or in some way "unwanted") and makes two things:

  • intercepts the "ACK" sent by the server so they do not reach the client that will consider the server as not responding
  • sends a reset to the server so that it will not keep the connection open waiting for traffic that will never come from the client
share|improve this answer
    
It happens during the SSL negotiaion; however, maybe the intermediate device thinks even trying to start an SSL session is a threat. Seems I have no choice but switch to another port. –  infgeoax Jun 26 '12 at 9:02
    
You are correct: my statement has to be corrected into "If it happens after the TCP connection..." –  marcoc Jun 26 '12 at 9:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.