user accessing server getting an error :Connection to partner broken

[karun44]

       Hi,

I have an user 172.26.216.7 trying to access server 155.111.150.125 port 3200 (behind firewall) getting an error message : connection to partner broken. I have captured the traffic and there is a TCP handshake between user and server. Below are the captures :

1: 14:57:41.589340 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: S 1277456660:1277456660(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,sackOK>

   2: 14:57:41.589462 802.1Q vlan#212 P0 155.111.150.125.3200 > 172.26.216.7.64430: S 465143236:465143236(0) ack 1277456661 win 8192 <mss 1380>

   3: 14:57:41.921903 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: . ack 465143237 win 32768

   4: 14:57:41.921949 802.1Q vlan#212 P0 155.111.150.125.3200 > 172.26.216.7.64430: P 465143237:465143293(56) ack 1277456661 win 8192

   5: 14:57:41.922330 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: P 1277456661:1277456975(314) ack 465143237 win 32768

   6: 14:57:42.456687 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: . ack 465143293 win 32712

   7: 14:57:42.456748 802.1Q vlan#212 P0 155.111.150.125.3200 > 172.26.216.7.64430: F 465143293:465143293(0) ack 1277456975 win 8192

   8: 14:57:42.788899 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: . ack 465143294 win 32712

   9: 14:58:54.796208 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: F 1277456975:1277456975(0) ack 465143294 win 32712

  10: 14:58:56.233432 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: F 1277456975:1277456975(0) ack 465143294 win 32712

  11: 14:58:59.100046 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: F 1277456975:1277456975(0) ack 465143294 win 32712

  12: 14:59:04.825366 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: F 1277456975:1277456975(0) ack 465143294 win 32712

  13: 14:59:16.260072 802.1Q vlan#212 P0 172.26.216.7.64430 > 155.111.150.125.3200: R 1277456976:1277456976(0) ack 465143294 win 0

13 packets shown

Please suggest if the above is a normal behaviour or I have missed anything.

[Jouni Forss]

Hi,

The captures would be easier to read if you copied the contents of the capture to a PC and opened it with wireshark or share the file here.

If I am not mistaken it seems to me that the server starts closing the connection with the users and it ends up with the user resetting the connection?

- Jouni

[karun44]

Hi Jouni,

Thanks for your reply. I am facing the same problem with other servers , where servers starts closing the session.At this moment i am guessing there is a problem at server side. Please find attched the Wireshark captures from client PC. Appreciate your reply