Hi,

I'm hoping someone can help with tracking down a connection reset problem which is causing me real grief at the moment. I've got a CentOS server (2.6.1 running Apache (2.2. and PHP (5.2.6). I have a script which allows a file to be uploaded (under 10MB) but during the upload at a seemingly random point, the connection is reset. Using Wireshark on the client side I see the server sends an [RST] packet and using tcpdump on the server side, I see the following:

Code:
<snip>
10:58:49.583759 IP (tos 0x0, ttl  64, id 8834, offset 0, length: 40) server.80 > client.4639: ., cksum 0xe256 (correct), 2802120852:2802120852(0) ack 3099425617 win 65535
10:58:49.602376 IP (tos 0x0, ttl 118, id 12554, offset 0, length: 1500) client.4639 > server.80: . 3099425617:3099427077(1460) ack 2802120852 win 49152
10:58:49.627785 IP (tos 0x0, ttl 118, id 12555, offset 0, length: 1500) client.4639 > server.80: . 3099427077:3099428537(1460) ack 2802120852 win 49152
10:58:49.627789 IP (tos 0x0, ttl  64, id 8835, offset 0, length: 40) server.80 > client.4639: ., cksum 0xd6ee (correct), 2802120852:2802120852(0) ack 3099428537 win 65535
10:58:49.648503 IP (tos 0x0, ttl 118, id 12556, offset 0, length: 1500) client.4639 > server.80: . 3099428537:3099429997(1460) ack 2802120852 win 49152
10:58:49.668670 IP (tos 0x0, ttl 118, id 12557, offset 0, length: 1500) client.4639 > server.80: P 3099429997:3099431457(1460) ack 2802120852 win 49152
10:58:49.668674 IP (tos 0x0, ttl  64, id 8836, offset 0, length: 40) server.80 > client.4639: ., cksum 0xcb86 (correct), 2802120852:2802120852(0) ack 3099431457 win 65535
10:58:49.692384 IP (tos 0x0, ttl 118, id 12558, offset 0, length: 1500) client.4641 > server.80: . 2564356044:2564357504(1460) ack 2806298425 win 49152
10:58:49.692388 IP (tos 0x0, ttl  64, id 28246, offset 0, length: 40) server.80 > client.4641: ., cksum 0xc125 (correct), 2806298425:2806298425(0) ack 2564357504 win 65535
10:58:49.716396 IP (tos 0x0, ttl 118, id 12559, offset 0, length: 1500) client.4639 > server.80: . 3099431457:3099432917(1460) ack 2802120852 win 49152
10:58:49.745699 IP (tos 0x0, ttl 118, id 12560, offset 0, length: 1500) client.4639 > server.80: . 3099432917:3099434377(1460) ack 2802120852 win 49152
10:58:49.745703 IP (tos 0x0, ttl  64, id 8837, offset 0, length: 40) server.80 > client.4639: ., cksum 0xc01e (correct), 2802120852:2802120852(0) ack 3099434377 win 65535
10:58:49.766565 IP (tos 0x0, ttl 118, id 12561, offset 0, length: 1500) client.4639 > server.80: P 3099434377:3099435837(1460) ack 2802120852 win 49152
10:58:49.788432 IP (tos 0x0, ttl 118, id 12562, offset 0, length: 1500) client.4641 > server.80: . 2564357504:2564358964(1460) ack 2806298425 win 49152
10:58:49.788436 IP (tos 0x0, ttl  64, id 28247, offset 0, length: 40) server.80 > client.4641: ., cksum 0xbb71 (correct), 2806298425:2806298425(0) ack 2564358964 win 65535
10:58:49.791478 IP (tos 0x0, ttl  54, id 34175, offset 0, length: 40) client.4641 > server.80: R, cksum 0xac99 (correct), 2564354584:2564354584(0) win 0
10:58:49.791480 IP (tos 0x0, ttl  54, id 34177, offset 0, length: 40) client.4640 > server.80: R, cksum 0xf992 (correct), 2741607055:2741607055(0) win 0
10:58:49.791482 IP (tos 0x0, ttl  54, id 34178, offset 0, length: 40) client.4640 > server.80: R, cksum 0xf526 (correct), 2741608187:2741608187(0) win 0
10:58:49.791627 IP (tos 0x0, ttl  54, id 34179, offset 0, length: 40) client.4638 > server.80: R, cksum 0xef09 (correct), 1721819619:1721819619(0) win 0
10:58:49.797519 IP (tos 0x0, ttl  54, id 34180, offset 0, length: 40) client.4638 > server.80: R, cksum 0xe955 (correct), 1721821079:1721821079(0) win 0
10:58:49.797520 IP (tos 0x0, ttl  54, id 34181, offset 0, length: 40) client.4638 > server.80: R, cksum 0xe3a1 (correct), 1721822539:1721822539(0) win 0
10:58:49.797522 IP (tos 0x0, ttl  54, id 34182, offset 0, length: 40) client.4638 > server.80: R, cksum 0xdded (correct), 1721823999:1721823999(0) win 0
10:58:49.797523 IP (tos 0x0, ttl  54, id 34183, offset 0, length: 40) client.4638 > server.80: R, cksum 0xd839 (correct), 1721825459:1721825459(0) win 0
10:58:49.797524 IP (tos 0x0, ttl  54, id 34184, offset 0, length: 40) client.4638 > server.80: R, cksum 0xd285 (correct), 1721826919:1721826919(0) win 0
10:58:49.797563 IP (tos 0x0, ttl  54, id 34185, offset 0, length: 40) client.4641 > server.80: R, cksum 0xa6e5 (correct), 2564356044:2564356044(0) win 0
10:58:49.803958 IP (tos 0x0, ttl  54, id 34186, offset 0, length: 40) client.4640 > server.80: R, cksum 0xef72 (correct), 2741609647:2741609647(0) win 0
10:58:49.803960 IP (tos 0x0, ttl  54, id 34187, offset 0, length: 40) client.4640 > server.80: R, cksum 0xe9be (correct), 2741611107:2741611107(0) win 0
10:58:49.804107 IP (tos 0x0, ttl  54, id 34188, offset 0, length: 40) client.4640 > server.80: R, cksum 0xe40a (correct), 2741612567:2741612567(0) win 0
10:58:49.804110 IP (tos 0x0, ttl  54, id 34189, offset 0, length: 40) client.4639 > server.80: R, cksum 0x037e (correct), 3099425617:3099425617(0) win 0
10:58:49.807652 IP (tos 0x0, ttl  54, id 34192, offset 0, length: 40) client.4639 > server.80: R, cksum 0xf815 (correct), 3099428537:3099428537(0) win 0
10:58:49.807655 IP (tos 0x0, ttl  54, id 34193, offset 0, length: 40) client.4639 > server.80: R, cksum 0xecad (correct), 3099431457:3099431457(0) win 0
10:58:49.807656 IP (tos 0x0, ttl  54, id 34194, offset 0, length: 40) client.4641 > server.80: R, cksum 0xa131 (correct), 2564357504:2564357504(0) win 0
10:58:49.807702 IP (tos 0x0, ttl  54, id 34195, offset 0, length: 40) client.4639 > server.80: R, cksum 0xe145 (correct), 3099434377:3099434377(0) win 0
10:58:49.807709 IP (tos 0x0, ttl  54, id 34196, offset 0, length: 40) client.4641 > server.80: R, cksum 0x9b7d (correct), 2564358964:2564358964(0) win 0
Unfortunately I am having trouble making any sense of this, it seems to me that the last 20 packets, the client sends a RST to the server but it looks like it's the other way round from the client.

Can anyone help me decipher the tcpdump and point me in the right direction to solving it? It's reproducible every time so if there is something I can do to diagnose further that would be helpful.

Thanks.