1

Trying to help someone with a situation where TCP connections get mysteriously dropped after a few minutes for no apparent reason (this happens even with non idle connections). Both client and server running linux and doing good outside of this case.

There's every reason to suspect some faulty router in between is doing it (there's some NAT involved).

How do I find which router is dropping the connection ?

Any tool like tcptraceroute but that'd keep a TCP connection open and keep probing it until it gets dropped ? (at which point we know who the culprit is)

3
  • Define "dropped". Do you mean that the connection is being closed with a FIN or RST, or that segments just stop showing up and eventually the connection is closed? – Evan Anderson Oct 17 '14 at 15:08
  • tcpdump capture shows the connection doesn't get closed, just no packets coming in after it happens. – lemonsqueeze Oct 17 '14 at 16:08
  • Is this picture identical on both the server and the client ? – drookie Oct 18 '14 at 5:03
2

I previously stated that tracing an established connection is impossible to do.
This, however, is wrong.

lcamtuf created the 0trace tool that allows TCP tracerouting using packets that match an established connection.
There is an improved version called intrace, and also Python version by Jon Oberheide.

The idea is to sniff for packets for a specified connection, then inject packets with matching TCP sequence numbers while increasing the TTL (just like usual traceroute does).

With several tries and some luck, you might be able to find the hop that starts to drop packets, as this hop will also drop your tracing packets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.