I have a client establish new TCP connection then sends request to a server per second. Both client and server are on the same linux box (via loopback interface).

The client periodically reports socket error. After digging the network packets, the error seems related to the TCP problem:

50123 > 7001 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=1326528350 TSecr=0 WS=128 [TCP ACKed lost segment] 7001 > 50123 [ACK] Seq=1 Ack=1834710718 Win=256 Len=0 TSval=1326528350 TSecr=1325798923 SLE=0 SRE=1 50123 > 7001 [RST] Seq=1834710718 Win=0 Len=0

I the above TCP segments, the client first send an TCP SYN to the server. In normal case, server should returns SYN-ACK with ack number=1, but in above snip, server returns ACK with wrong ack number=1834710718. Because the ack number is wrong, client RST the connection.

Any idea about this case?

  • From the looks of it, the server is not returning an ACK with the wrong number. Rather Wireshark is correct in telling you that there are missing segments. Specifically, you are missing the SYN/ACK response from the server, ACK from the client, and then at least one data frame from client to server... which is then ACK-ed by the server in the packet that you did capture. To me that shows that your packets are getting through (at least initially), but you are not capturing them. Is your pcap setup correct? – Jeremy Gibbons Jan 14 '16 at 6:37
  • My pcap setup: tcpdump -B 40960 -i lo tcp port 5566 -nn -p -q -A -v -s 1024 -w capfile.cap Note that there is no kernel dropped packets after close tcpdump. – okwap Jan 14 '16 at 6:53
  • 1
    Thinking about it again, it looks like you are using relative sequence numbers (and the Seq=0 bears that out). So the Ack value is bizarrely high. Could you be encountering the problem described here: <serverfault.com/questions/297134/…> in the second response ? Essentially, if you re-use the src-prt/dst-prt combination too quickly after a previous session was closed, the kernel gets confused and sends an ACK for the previsou session, rather than a SYN/ACK for the new one. – Jeremy Gibbons Jan 14 '16 at 7:49

R u sure, that you implemented your server right? It sounds like an implementation error, but without code segments it's best impossible to determine if this is right

  • Why are you asking a question in an area desginated for an ANSWER only? This is more appropriate for being in a comment than in the answer area. – Pimp Juice IT Jan 14 '16 at 6:10

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.