Questions tagged [tcp]
TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.
1,655
questions
74
votes
9
answers
149k
views
How passively monitor for tcp packet loss? (Linux)
How can I passively monitor the packet loss on TCP connections to/from my machine?
Basically, I'd like a tool that sits in the background and watches TCP ack/nak/re-transmits to generate a report on ...
0
votes
0
answers
28
views
TCP & Wireshark: Retransmission not working?
I traced a TCP connection in wireshark and try to understand how ACK'ing should work correctly.
As you can see in the picture at some point there's a paket missing from IPx.61. Wireshark tags this ...
3
votes
2
answers
38k
views
Cannot ping through one of the network interfaces
Setup
ubuntu linux VM ( virtual-box) is configured with two interfaces, eth0 and eth1.
eth0 is on a bridged network and directly connected to external network.
eth1 is on "nat network", which is ...
1
vote
0
answers
52
views
TCP & Wireshark - Server not re-transmitting segments?
I am new to TCP-in-depth-analysis which I need for a current problem.
Connections:
Client = Host PC, Ubuntu 22.04.4 LTS (IP: ...60)
Switch (TL-SG1016D by tp-link, Gbit)
Server = Proprietary embedded ...
0
votes
0
answers
33
views
Looking to monitor activity regarding connection attempts to closed ports on my system, what log file in should i look in? Ubuntu
I'm looking to monitor activity regarding connection attempts to closed ports on my system, as part of a server side portknocking implemetation. However, I am confused about what log file in ...
1
vote
1
answer
4k
views
iperf test in reverse direction gives different result
I used iperf to measure the max throughput for TCP connection between two ubuntu machines. Both the machines were directly connected be means of a 1Gbps cable. When I performed iperf tests i obtained ...
0
votes
1
answer
26
views
RateLimit is doing weird maths and wrong numbers on kernel
I'm trying to apply a set of rate limit within iptables, and it's doing some weird maths that i'm not able to see on the kernel why this is happen.
I tried to execute same code on my local machine, ...
0
votes
0
answers
142
views
IP over LoRa: TCP timeout
I am trying to tunnel IP packets via LoRa. For this I use two devices running Meshtastic.
Using ICMP I was able to determine that there is a packet loss of about 30% of the packets and a latency of ...
0
votes
0
answers
100
views
NGINX Reverse Proxy Server sending RST to upstream and FIN to downstream after 5 Minutes of inactivity
My current nginx setup always kill the TCP connection after 5 minutes of inactivity, i.e no transaction.
I have this setup which requires TLS1.2 connection connecting from my internal network [client ...
0
votes
0
answers
56
views
AWS ALB: Are Sticky Sessions possible with TCP?
I need to load-balance my clients. Some of these clients use TCP/TLS, the rest HTTP/HTTPS.
The target services of the load balancer can be in either EC2 instances or ECS containers.
Also, the clients ...
1
vote
2
answers
236
views
TCP port forwarding/tunneling by file sharing
I have a Linux server and a windows client. A folder is shared between these machines with read and write access for both of them.
I want to access a production database from my development machine, ...
0
votes
0
answers
97
views
TCP_NODELAY for All current sockets in linux
i want lowest latency network with tcp_nodelay., in windows OS we can easily enable TCP_NODELAY through registry of windows. i searched on the red hat website and another website but up to now, my ...
0
votes
0
answers
632
views
OpenVPN TCP connection to firewall failing: unknown error
I am encountering an error when attempting to connect to my office using OpenVPN. The error message:
Tue Jul 18 12:34:52 2023 WARNING: Compression for receiving enabled. Compression has been used in ...
0
votes
1
answer
38
views
What happens if a TCP implementation retransmits different data? [closed]
No sensible TCP implementation would do this, but does anyone know what happens in practice if a TCP endpoint retransmits different data for particular sequence numbers? I couldn't find anything in ...
12
votes
3
answers
50k
views
How to kill a TCP connection using tcpkill utility
I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as:
tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
31
votes
2
answers
7k
views
Under what circumstances is TCP-over-TCP performing significantly worse than TCP alone (2014)?
Many admins keep perpetuating - on ServerFault and elsewhere - how bad of an idea TCP-over-TCP is, e.g. in VPNs. That even the slightest packet loss will make one suffer from at least severe ...
-1
votes
1
answer
61
views
How does real server, direct return server (DRS), reply to client if a load balancer (LB) uses port address translation (PAT)?
Direct Return Server overview:
The DRS allows real servers to directly reply to a client without going through load balancer (LB). The LB ip (VIP) is configured as a loopback (localhost) ip for the ...
0
votes
1
answer
62
views
How to route TCP traffic through a fixed IP in Azure during local development?
Hello ServerFault Community,
I'm working through a challenge related to accessing a third-party OPC UA server and am considering a solution using Azure's cloud infrastructure.
Background
Our team ...
0
votes
1
answer
36
views
Can iptables state miss some packets?
I tried to setup the iptable rules for MTA. As this MTA is meant only for receiving the emails I allowed INPUT packets from any to destination port 25 with state either new or established, and allowed ...
2
votes
1
answer
4k
views
Nginx TCP stream routing based on source IP
I have configured nginx as a reverse proxy for a TCP (non-http) stream.
I'd like to apply different routing for a particular source IP address - can this be done, and how? I'm aware of recomendations ...
1
vote
3
answers
4k
views
Limit Number of TCP connections in Linux Server, to avoid attack
I want to limit the number of TCP connections in Linux server, I have used the following command.
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit
--connlimit-above 25 --connlimit-mask 32 -...
0
votes
0
answers
25
views
Data from NF Tables to IP Tables
I have input data like below for NF Tables:
nft add rule filter input tcp flags != syn
nft add rule filter input tcp flags &syn!= syn
add rule filter output tcp flags & (syn | ack) == syn | ...
0
votes
0
answers
44
views
Parsing TCP flag Data for IP Tables
I have input file which has data like below
chain:VARIABLE_IN ip_version:v4 proto:tcp sport:5401 dst_ip:18.159.158.206 dport:5432 decision:a tcpflags:&syn!=syn
My code reads above data to form ...
0
votes
0
answers
64
views
How to set TCP flags "&syn!=syn" in iptables?
I have requirement where am getting parameters to set in iptables as below:
Rate Limit = 1/sec
Source port = 5432
Source IP = 203.0.113.0
Protocol = tcp
TCP flags = &syn!=syn
iptables -A PRIO_IN -...
1
vote
2
answers
890
views
nftables: Possible to block SYN packets with payload?
Is it possible to drop all TCP SYN packets with a payload using nftables?
The man pages mention various length options, but none that I could get to work for TCP packets without syntax errors.
I am ...
0
votes
2
answers
2k
views
Server Dropping all Connections Randomly and Packet Loss
I just built a server using a Supermicro X8DAH+-F board and running Ubuntu 10.04 Server 64bit. This has the Intel 82576 dual port controller (one port is disabled). Since this is a server, remote ...
2
votes
2
answers
5k
views
How to measure TCP connection time in Linux
I want to measure the overhead in creating a TCP connection.
I know of many tools like hping and netperf, but they seem oriented at measuring latency.
I want to know how long the 3-way handshake ...
18
votes
5
answers
73k
views
How to check TCP timeout in linux / macos?
I have a network problem on my MacOS that i need to troubleshoot. I know that TCP socket has internal timeout that will close connection if remote party is not responding (but no graceful disconnect ...
0
votes
1
answer
167
views
Remote Desktop intermittent connection issues
this post is related to this:Remote desktop connection by host name vs IP address
but there's more info to be presented so decided to post a new one.
when connecting to remote desktop using the ...
0
votes
1
answer
5k
views
Kubernetes (K8S): TCP clients waiting very long timeout on connection to a Service when there are no Pods serving its requests
My problem occured when using Redis on Kubernetes, but it seems that it is not a problem with Redis itself, but with network/infrastructure.
My scenario:
I have a Redis Service with single Redis Pod ...
0
votes
0
answers
107
views
TCP 3-Way Handshake Issue: Client not responding with ACK
I have a Java application running inside a virtual machine (VM) that uses S3-compatible storage as an object data store. Periodically, the VM is destroyed, re-deployed, and reconfigured. During the ...
0
votes
2
answers
4k
views
How can I avoid the error TCP_MISS_ABORTED/000 when uploading files through squid?
While uploading big files, > 10MB, through a squid V5.6, I noticed that they failed and/or were retried.
The error has been logged multiple times in the logs:
1671092710.452 423 ::1 ...
0
votes
0
answers
86
views
Windows service on Windows Server 2019 stops accepting IoT device connections on public IP address and domain name
We are investigating an issue on Windows Server 2019. It runs a Windows Service that accepts TCP/IP connections (TCP/IP service bound to IP address 0.0.0.0, so listening on all network adapters). ...
3
votes
2
answers
5k
views
TCP connection RST after FIN, ACK
I have a situation that would like to clarify with the experts here. I am no network expert so maybe it's normal, but i rather ask.
We are trying to diagnose a problem between two servers, both are ...
1
vote
3
answers
211
views
I need a packet-level explanation of how HTTP redirects to HTTPS
I am programming an embedded web server and trying to figure out how to redirect all incoming SYN packets on port 80 to redirect to port 443. Everything I've found online is in the context of Apache, ...
18
votes
2
answers
64k
views
How can I search the info column in Wireshark?
Wireshark | Windows
I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
1
vote
1
answer
77
views
TCP connection not arriving at process depending on source interface
I have a strange case where a TCP connection seems to not arrive on the listening socket, depending on the source interface.
The context: I'm trying to configure the Zabbix agent on a specific host (...
2
votes
0
answers
206
views
How to debug curl when netcat works?
The following cURL command hangs:
$ curl -v http://1.1.1.1/*
Trying 1.1.1.1:80...
* Connected to 1.1.1.1 (1.1.1.1) port 80
> GET / HTTP/1.1
> Host: 1.1.1.1
> User-Agent: curl/8.3.0
> ...
0
votes
1
answer
733
views
First packet isn't SYN
A Windows Server 2016 in DMZ is calling a time stamp provider service on HTTPS outside the company. The DMZ server is not a high traffic one, making around 2000 calls to the external provider per day. ...
0
votes
0
answers
204
views
NGINX TCP reverse proxy resolves queries differently
The Setup
I currently have a server and a mongodb database running in the cloud (Oracle Cloud Infrastructure).
The Problem
My connection to the database is bound by a select number of static IP's. ...
0
votes
1
answer
208
views
Linux TCP tuning to overcome choking uplink
A linux computer is on a network link which exhibits the following behaviour:
good download speeds
upload/uplink starts well but after a few seconds drops to close to nothing. The Send-Q and Recv-Q ...
53
votes
9
answers
122k
views
Why would a server not send a SYN/ACK packet in response to a SYN packet
Lately, we've become aware of a TCP connection issue that is mostly limited to mac and Linux users who browse our websites.
From the user perspective, it presents itself as a really long connection ...
0
votes
0
answers
25
views
Allow access to local mongodb database to a different network
Is it possible to do tcp port forwarding using windows settings without having to access router settings? I am trying to give access to my local mongodb database to someone on a different network to ...
0
votes
1
answer
103
views
How does NGINX Plus handle server failure when doing session persistence for TCP/UDP communication?
My understanding from the NGINX Plus documentation is that their Load Balancing will route around servers that are down or swamped and that Session Persistence attempts to maintain the same server for ...
0
votes
0
answers
83
views
Repeated TCP DUP ACK of the same initial packets
I'm using Wireshark to analyze one of the TCP conversations in my packet capture and I have this sequence where the entire conversation between these two ports is made out of TCP DUP ACK for the same ...
0
votes
0
answers
118
views
Pgpool-II connection pooling with Load balancing disabled still make request to stand by DB node. Causing client to disconnect
I have a problem with pgpool-II load balancer. Currently I have turned off pgpool-II load balancer but somehow it still made request to my standby node. How can this happen? This make my child go ...
0
votes
0
answers
41
views
TCP connection severing in Two arm load balanced environment using Kemp LoadMaster connecting to Centos servers
The configuration is one that I inherited but the connection from the LoadMaster to two appserver ends up occasionally getting severed. This will happen to each server independently, and only seems ...
0
votes
1
answer
312
views
Understanding TCP RST Network Capture
I only really need help understand the following image, but I will give the background for context.
We have an app that is configured to use a proxy on port 8080 and requires Internet access. At ...
1
vote
1
answer
37
views
Web browser fails to connect to website after 100 refreshes on client
I'm using an HTTP meta-refresh to execute a script multiple times.
After 100 refreshes, the browser stalls.
According to devtools, the browser doesn't even complete an initial connection to the server....
0
votes
0
answers
141
views
Automatic TCP SYN - cookie activation
I am simulating a SYN flood attack on a Raspberry Pi 1 with KALI Linux (ARM) installed.
A similar message as mentioned in this post was printed after performing the attack: How to avoid syn cookies.
...