2

I've been experiencing some issues with two servers that I have with my VPS hosting provider where I've been getting intermittent connection errors.

I've done LAN traces from the server and I spotted what I believe is an issue between the load balancer (provided by the hosting provider) connecting to the server.

In the trace I see the load balancer send a SYN, the server responds with SYN ACK and then the load balancer sends back RST ACK as shown in the snippet below

LAN trace snippet

192.168.255.20 being the load balancer and 192.168.173.16 being the server.

From my understanding of TCP, seeing RST packets in a trace is a bad thing as it means packet not recognised, invalid connection, socket not open etc and its aborting connection due to an issue.

I queried this with my hosting provider and they said its normal, its just part of a TCP health check between the load balancer and the server.

This striked me as a little odd, I can't find anything specific about TCP health check doing something different than just a normal TCP connection, but I assumed the health check is as simple as open connection to socket and then close.

I tested this while doing a trace from my laptop to a linux box at home and then I see laptop sends SYN, receive SYN ACK, laptop sends back ACK. When I disconnect I then get FIN followed by FIN ACK from each device to close the connection. This is what I was expecting to see from the load balancer.

I queried this again with my hosting provider and they have come back with the following statement:

The important packet in the TCP Health Check is the "SYN ACK" coming from the back end Node. The "RST ACK" simply discards the connection once the back end Node demonstrates that the TCP protocol is up and responding with a "SYN ACK" packet.

It is a Health Check, not a connection, per se.

Does this sound correct, as I can't see anything about specific TCP health checks and that an RST packet in this case would be expected.

Thanks

Improve this question
2
  • I got this question too. But after searching there is no specific reason for doing this. I got from some expert that it is usually done for improve performance since it will have less handshake than normal connection. And this true. However this will cause some software (like java that do not have raw socket supports) to handle it in difficult sometimes.
    – liubao68
    Sep 12, 2018 at 1:29
  • Its rather odd, also doing this puts the socket into TIME_WAIT so keep the socket handle unavailable for another connection for a defined timeout, I think its around 2-4 minutes
    – Boardy
    Oct 13, 2018 at 12:28

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .