topic From what I can tell RRRRR in Network Security

What does the "RRRRR" ping result mean?

adil.nasser3 — Tue, 12 Mar 2019 04:02:39 GMT

Hi,

What does the "RRRRR" ping result mean in the below output?

fw-a/pri/act# ping tcp dmz 1.1.1.1 8002 source 2.2.2.2 1024
Type escape sequence to abort.
Sending 5 TCP SYN requests to 172.30.98.153 port 8002
from 172.30.99.153 starting port 1024, timeout is 2 seconds:
RRRRR

Thank you,

Adil

I couldn't find any specific

Marvin Rhoads — Mon, 07 Apr 2014 17:53:00 GMT

I couldn't find any specific reference to the "R" code.

If I were to hazard an educated guess, I would look at a possible Routing issue.

You could also capture the traffic and look at the actual icmp code in the trace file.

I finally found out what

adil.nasser3 — Mon, 05 May 2014 14:25:47 GMT

I finally found out what "RRRRR" means. It means the destination host sent back a reset.

Adil

nice! haven't seen 'R' yet on

johnlloyd_13 — Tue, 06 May 2014 12:45:35 GMT

nice! haven't seen 'R' yet on an ASA.

It happens once a year on

Marvin Rhoads — Tue, 06 May 2014 13:22:30 GMT

It happens once a year on Talk Like a Pirate Day. 😛

lol there's now a 'like' in

johnlloyd_13 — Tue, 06 May 2014 13:35:40 GMT

lol

there's now a 'like' in CSC.

Hi adil, If RRRR means Reset

shankarkganesh — Wed, 05 Aug 2015 14:45:10 GMT

Hi adil,

If RRRR means Reset.can yo help me in identifying TTTT means, is it timeout?

CC-F1#ping tcp 10.236.20.50 8081 s 10.252.137.100 2222
Type escape sequence to abort.
Sending 5 TCP SYN requests to 10.236.20.50 port 8081
from 10.252.137.100 starting port 2222, timeout is 2 seconds:
TTTTT
Success rate is 0 percent (0/5)

Regards,

Shankar Ganesh A

Hi Marvin,

ROHIT SHARMA — Mon, 15 Feb 2016 12:05:05 GMT

Hi Marvin,

what is the source when I don't put any source in ping tcp command?

Its strange that a ping tcp is successful when I don't put any source, but fails when I put firewall's outside interface's IP.

I captured and found that in both cases its using same IP. ...

I am confused

The source interface is by

Marvin Rhoads — Mon, 15 Feb 2016 13:46:44 GMT

The source interface is by default the one that the routing table selects as the best path to the destination.

Om a firewall you cannot source a ping from, say the outside interface, to a host on the inside.

I have put a capture and can

ROHIT SHARMA — Mon, 15 Feb 2016 13:50:43 GMT

I have put a capture and can see that in both cases, source is OUTSIDE interface's IP.

But the ping is successful when I don't put any source. Its timed out when I put source as OUTSIDE interface's IP

Something seems contrary to

Marvin Rhoads — Mon, 15 Feb 2016 14:21:36 GMT

Something seems contrary to waht I'd expect.

Here is the output showing my firewall pining a public address.

Source from inside = fail

Source from outside = pass

Source without specifying interface = pass (uses the outside per the routing table)

asa-5512# ping inside 8.8.8.8 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
asa-5512# ping outside 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/14/20 ms
asa-5512# ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/14/20 ms
asa-5512#

Ohh. i think you

ROHIT SHARMA — Mon, 15 Feb 2016 14:37:17 GMT

Ohh. i think you misunderstood me.

I am talking about tcp ping.

ASA# ping tcp 1.2.2.2 443

Type escape sequence to abort.

No source specified. Pinging from identity interface.

Sending 5 TCP SYN requests to 1.2.2.2 port 443

from 11.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/28

************************

ASA# ping tcp 1.2.2.2 80 source 11.1.1.1 45454
!!!!!!! FAIL

Hello ROHIT SHARMA,

Danila Khadarovich — Fri, 11 Mar 2016 14:10:15 GMT

Hello ROHIT SHARMA,

Just want to denote that in the second case you use DST PORT = 80 (HTTP)..

1) ASA# ping tcp 1.2.2.2 443

2) ASA# ping tcp 1.2.2.2 80 source 11.1.1.1 45454

From what I can tell RRRRR

bogdan.zuyev — Wed, 03 Aug 2016 20:06:08 GMT

From what I can tell RRRRR means that the remote port you are trying to ping is closed.

ASA5512# ping tcp 10.200.100.18 443
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 10.200.100.18 port 443
from 10.10.10.1, timeout is 2 seconds:
RRRRR
Success rate is 0 percent (0/5)
ASA5512#
ASA5512#
ASA5512#
ASA5512# ping tcp 10.200.100.18 3389
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 10.200.100.18 port 3389
from 10.10.10.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
ASA5512#

Hope this helps

Cheers