1

Scenario: Client connects to Server using TCP/IP.

Issue: During initial TCP/IP connection setup, the ACK packet [3rd step in TCP] sent from Client to Server has crossed the firewall [evidence from tcpdump] but not reached the server. Therefore server ignores all the packets sent from Client after ACK packet [3rd step in TCP] and Server tries to send SYN/ACK packet [2nd step in TCP] after few seconds to Client again [and the step repeats]. Finally Server sends Reset request to Client.

When we captured the network traffic using wireshark in the server, the ACK packet [3rd step in TCP] never came to the server.

This issue happens for the first time, if we attempt to TCP/IP connect when the connection was not used in past 10 minutes. But within 10 minutes, if we perform TCP/IP connection, it connects successfully. So, the connection fails only for the first attempt when tried after 10 minutes anytime.

We could not spot where and what the issue is. Please can you provide your inputs?

Thank you.

Saravanan N

  • Look for any network filtering devices between the firewall and server. Otherwise your tcpdump on the firewall is probably monitoring the wrong interface. – user2320464 Sep 18 '15 at 15:48
  • Somewhere, there's a stateful firewall that times out connection state in ten minutes. – David Schwartz Sep 18 '15 at 17:33
  • Thanks for sharing your inputs. The issue was the packets were getting lost in the OS where firewall is running. It got solved when the firewall Operating System was patched. – Saravanan N Sep 30 '15 at 16:10
0

Thanks for sharing your inputs. The issue was the packets were getting lost in the OS where firewall is running. It got solved when the firewall Operating System was patched

  • Saravanan N

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.