1

We got randomly TCP "reset" error when we send request to remote server.

Log from remote server

Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection 640068283 for Outside:xxxx to xxxx duration 0:00:00 bytes 4160 TCP Reset-O

One my local machine I saw when I use netstat 

100703 connections reset due to unexpected data
324186 connections reset due to early user close

I also use tcpdump to see what's wrong with it, I saw

xxxx.https: Flags [R.], seq 290, ack 1369, win 136, options [nop,nop,TS val 2871790533 ecr 1897173283], length 0

The problem just happened today, we didn't change anything on our server. Anyone know what's wrong with it?

Is it related to code we wrote send out request or related to linux configuration？

Improve this question
3
  • 3
    We're going to need to know more about what the application is that you're accessing on the server. It's not normal for the Linux kernel to send random RSTs, however if your application is having some kind of unexpected failure it may well be RST'ing the connection.
    – Evan Anderson
    Nov 8, 2013 at 15:15
  • 1
    So which end is sending the TCP RST?
    – rickhg12hs
    Nov 8, 2013 at 22:52
  • I would suggest based on the "unexcpected data" and the message from the ASA tearing down the connection it is the destination that is triggering the RST.
    – Backtogeek
    Nov 9, 2013 at 18:43

1 Answer 1

Reset to default
3
+25

I think the real clue is here: %ASA-session-6-302014

You usually see this on a Cisco ASA firewall, it looks like you are triggering an event or rule in the Cisco firewall with your traffic causing it to tear down the connection.

If you have no access to the Cisco ASA then give that log line to the person who does and ask them to tell you why it stopped the connection, it is probably triggering an ACL of some sort or it could be rate limiting.

Unless you can give us the full ASA config or give us a LOT more information on the connection and service we will never be able to pin point this for you, if I had to place a bet I would say the ASA thinks you are port scanning or you are sending to much traffic to fast and it is tearing down connections to rate limit you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .