1

Could someone please take a look at this tcpdump and let me know if the issue is with my Client, or Server, or the Connection, for the first 6 connection attempts that the server did not respond to:

07:17:01.493983 IP clientIP.20482 > serverIP: Flags [S], seq 221084411, win 5840, options [mss 1460,sackOK,TS val 193965 ecr 0,nop,wscale 1], length 0
07:17:04.491104 IP clientIP.20482 > serverIP: Flags [S], seq 221084411, win 5840, options [mss 1460,sackOK,TS val 194265 ecr 0,nop,wscale 1], length 0
07:17:10.490685 IP clientIP.20482 > serverIP: Flags [S], seq 221084411, win 5840, options [mss 1460,sackOK,TS val 194865 ecr 0,nop,wscale 1], length 0
07:17:21.691846 IP clientIP.46417 > serverIP: Flags [S], seq 546275412, win 5840, options [mss 1460,sackOK,TS val 195985 ecr 0,nop,wscale 1], length 0
07:17:24.692264 IP clientIP.46417 > serverIP: Flags [S], seq 546275412, win 5840, options [mss 1460,sackOK,TS val 196285 ecr 0,nop,wscale 1], length 0
07:17:30.691750 IP clientIP.46417 > serverIP: Flags [S], seq 546275412, win 5840, options [mss 1460,sackOK,TS val 196885 ecr 0,nop,wscale 1], length 0
07:17:42.023667 IP clientIP.43470 > serverIP: Flags [S], seq 856560235, win 5840, options [mss 1460,sackOK,TS val 198018 ecr 0,nop,wscale 1], length 0
07:17:42.023714 IP serverIP > clientIP.43470: Flags [S.], seq 1105326492, ack 856560236, win 14480, options [mss 1460,sackOK,TS val 1184649594 ecr 198018,nop,wscale 7], length 0
07:17:42.199740 IP clientIP.43470 > serverIP: Flags [.], ack 1, win 2920, options [nop,nop,TS val 198036 ecr 1184649594], length 0
07:17:42.458127 IP clientIP.43470 > serverIP: Flags [P.], seq 1:171, ack 1, win 2920, options [nop,nop,TS val 198061 ecr 1184649594], length 170
07:17:42.458156 IP serverIP > clientIP.43470: Flags [.], ack 171, win 122, options [nop,nop,TS val 1184650028 ecr 198061], length 0
07:17:42.468977 IP serverIP > clientIP.43470: Flags [P.], seq 1:365, ack 171, win 122, options [nop,nop,TS val 1184650039 ecr 198061], length 364
07:17:42.470211 IP serverIP > clientIP.43470: Flags [F.], seq 365, ack 171, win 122, options [nop,nop,TS val 1184650040 ecr 198061], length 0
07:17:42.649652 IP clientIP.43470 > serverIP: Flags [.], ack 365, win 3456, options [nop,nop,TS val 198081 ecr 1184650039], length 0
07:17:42.689039 IP clientIP.43470 > serverIP: Flags [.], ack 366, win 3456, options [nop,nop,TS val 198085 ecr 1184650040], length 0
07:17:42.813097 IP clientIP.43470 > serverIP: Flags [F.], seq 171, ack 366, win 3456, options [nop,nop,TS val 198097 ecr 1184650040], length 0
07:17:42.813114 IP serverIP > clientIP.43470: Flags [.], ack 172, win 122, options [nop,nop,TS val 1184650383 ecr 198097], length 0
  • Did you take this capture from the client or server? Based on the timings between SYN > SYN/ACK I'm assuming server? – Mark Riddell Aug 26 '16 at 6:56
  • took from server – James Gu Aug 26 '16 at 21:38
1

Without knowing any information about the state of the TCP sockets on your server, all I can say is that this looks like a server side issue. The client tried to connect to your server using two separate sockets and only on the third connection attempt did the server respond correctly with a SYN/ACK.

Now it is entirely possible that the two initial connection attempts were invalid in some way and the TCP stack was correct to ignore them. It is also possible that the server was simply unable to accept the new connection attempt - perhaps load related, an iptables rule, sysctl variable or some other rate-limiting feature.

So whilst I can say that it is the server that is at fault here by not completing the TCP handshake however unless you provide a lot more information about the state of the systems involved, I cannot say whether this is an actual issue or a feature of some other piece of configuration or system condition.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.