1

Scenario: Client connects to Server using TCP/IP.

Issue: During initial TCP/IP connection setup, the ACK packet [3rd step in TCP] sent from Client to Server has crossed the firewall [evidence from tcpdump] but not reached the server. Therefore server ignores all the packets sent from Client after ACK packet [3rd step in TCP] and Server tries to send SYN/ACK packet [2nd step in TCP] after few seconds to Client again [and the step repeats]. Finally Server sends Reset request to Client.

When we captured the network traffic using wireshark in the server, the ACK packet [3rd step in TCP] never came to the server.

This issue happens for the first time, if we attempt to TCP/IP connect when the connection was not used in past 10 minutes. But within 10 minutes, if we perform TCP/IP connection, it connects successfully. So, the connection fails only for the first attempt when tried after 10 minutes anytime.

We could not spot where and what the issue is. Please can you provide your inputs?

Thank you.

Saravanan N

Improve this question
3
  • Look for any network filtering devices between the firewall and server. Otherwise your tcpdump on the firewall is probably monitoring the wrong interface.
    – user2320464
    Sep 18, 2015 at 15:48
  • Somewhere, there's a stateful firewall that times out connection state in ten minutes.
    – David Schwartz
    Sep 18, 2015 at 17:33
  • Thanks for sharing your inputs. The issue was the packets were getting lost in the OS where firewall is running. It got solved when the firewall Operating System was patched.
    – Saravanan N
    Sep 30, 2015 at 16:10

1 Answer 1

Reset to default
0

Thanks for sharing your inputs. The issue was the packets were getting lost in the OS where firewall is running. It got solved when the firewall Operating System was patched

  • Saravanan N
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .