1

server1 (suse linux) should be able to connect to server2 (redhat linux) on ports 4750 and 1080.

when server1 connect to server2 (using telnet as a test) using 4750, the connection stays up and open. When connecting over port 1080, the connection appears to stay open for 30-31seconds and is then closed by foreign host.

There is a firewall in between these 2 servers but rules have been checked and both connections use the same rule so therefore is not the issue.

server2 is listening on port 1080 and for the brief 30 seconds, the connection changes to 'ESTABLISHED'.

Before telnet test on server2:

[root@server2 ~]# netstat -an | grep 1080
tcp        0      0 server2:1080             0.0.0.0:*                   LISTEN

During telnet test on server2

[root@server2 ~]# netstat -an | grep 1080
tcp        0      0 server2:1080             0.0.0.0:*                   LISTEN
tcp        0      0 server2:1080             server1:29168        ESTABLISHED

1080 is the port that is used between the 2 servers for Dante SOCKS proxy software. The SOCKS proxy software has allowed traffic on the correct IP's and ports for this traffic to be allowed.

Output from tcpdump is as follows:

[root@server2 ~]# /usr/sbin/tcpdump -i eth0 src server1 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 10:50:02.891703 IP server1.7635 > server2.ssad: Flags [F.], seq 2464814842, ack 3473489221, win 1460, options [nop,nop, TS val 1718333730 ecr 597351227], length 0 10:50:02.924026 IP server1.7635 > server2.ssad: Flags [.], ack 2, win 1460, options [nop,nop,TS val 1718333738 ecr 5974 30239], length 0 10:50:04.931293 IP server1.boe-was > server2.ssad: Flags [S], seq 2566885367, win 5840, options [mss 1460,sackOK,TS val 1718334240 ecr 0,nop,wscale 2], length 0 10:50:04.959923 IP server1.boe-was > server2.ssad: Flags [.], ack 446565749, win 1460, options [nop,nop,TS val 17183342 47 ecr 597432274], length 0 10:51:01.043599 IP server1.boe-was > server2.ssad: Flags [F.], seq 0, ack 1, win 1460, options [nop,nop,TS val 1718348268 ecr 597432274], length 0 10:51:01.073732 IP server1.boe-was > server2.ssad: Flags [.], ack 2, win 1460, options [nop,nop,TS val 1718348276 ecr 597488388], length 0 10:51:06.034802 IP server1.odnsp > server2.socks: Flags [S], seq 2624756191, win 5840, options [mss 1460,sackOK,TS val 1718349516 ecr 0,nop,wscale 2], length 0 10:51:06.063340 IP server1.odnsp > server2.socks: Flags [.], ack 1984288685, win 1460, options [nop,nop,TS val 1718349523 ecr 597493378], length 0 10:51:37.129909 IP server1.odnsp > server2.socks: Flags [F.], seq 0, ack 2, win 1460, options [nop,nop,TS val 1718357290 ecr 597524444], length 0

I'm assuming from the above output that [F.] means 'connection closed by foreign host'?

And, where: ssad = port 4750 socks = port 1080

What are some other things to check and how do I determine what is actually closing the connection?

Improve this question
3
  • 1
    I would first look at a packet capture from server2 to confirm that the closing packet is indeed send by server2. Additionally I would look through the trace to see if anything odd is happening.
    – kasperd
    Apr 20, 2015 at 4:57
  • You could use TCPDUMP for packet capture.
    – Seth
    Apr 20, 2015 at 6:07
  • kasperd, I've added more info from a tcpdump from server2 in the original post. Is this the type of trace you're looking for?
    – Mei T
    Apr 20, 2015 at 6:29

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .