[RST, ACK] traffic

[neo_christina]

Hi,

I would really appreciate some help on the following problem encountered:

The users are trying to access to a website but failed.

Hence, I simulated as a user accessing to the website and sniffed the traffic and found that there are many [RST, ACK] statements. Kindly advise what causes the many [RST, ACK] statements?

Btw, there are no firewall rules blocking. Any similar encounters? and any advise on what to look out for?

Thanks

Christina

[Richard Burts]

Christina

Do I understand correctly that the packet that you see has the RST bit set and also the ACK bit set?

The ACK bit indicates a response packet. The RST is an abnormal termination of a TCP session (the FIN bit represents a normal termination). It sounds like devices on your end are initiating sessions, find something that they do not like and terminating. It sounds like what you are seeing is the acknowledgement from the server to your reset of the connection. Perhaps you can tell us a bit more about what if anything came in the trace before the RST, ACK?

HTH

Rick

[neo_christina]

Hi Rick,

There are also many of the following messages:

- HTTP [TCP Previous segment lost] Continuation or non-HTTP traffic

- TCP [TCP Retransmission] [TCP segment of a reassembled PDU]

- TCP [TCP Dup ACK]

- TCP [TCP ACKed lost segment]

and some of the following messages:

- HTTP [TCP Out-Of-Order] Continuation or non-HTTP traffic

It seems that the packets are duplicated and lost many times.

Thanks

Christina

[Richard Burts]

Christina

These messages would seem to indicate that there is a lot of packet loss and perhaps lots of delay in delivering packets that cause the sending station to retransmit (this is a normal part of TCP and is not a problem when done in small amounts). It looks like the amount of retransmitted packets contributes especially to the Dup ACK, and Out-Of-Order error messages.

Can you categorize these in any way? Are they associated mostly with particular destinations? Are they associated with particular source stations? Are they worse in some parts of your network than in others? If we can understand this traffic a bit better we might be able to find ways to address the issue.

HTH

Rick

[neo_christina]

Hi Rick,

the test is from internal and external network to the web server. internal network seems ok. however, regional network connecting to the internal network has problems.

Thanks

Christina