Find the answer to your Linux question:
Results 1 to 2 of 2
I am looking at an issue where two machines can't talk to each other. Server is a protprietary UNIX system with "fairly old" TCP/IP stack implementation. Client is MontaVista Linux ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Aug 2006
    Posts
    1

    PROBLEM - TCP client send RST after SYN/ACK


    I am looking at an issue where two machines can't talk to each other. Server is a protprietary UNIX system with "fairly old" TCP/IP stack implementation. Client is MontaVista Linux with 2.4 kernel.

    Client sends SYN, Server replies with SYN/ACK and the client immediately sends RST. I can't see anything out of whack in the TCP/IP headers. Could someone give me a clue what might be happening here? I have ran out of ideas ...

    Code:
    No.     Time        Source                Destination           Protocol Info
          1 0.000000    172.17.223.221        172.16.23.75          TCP      35530 > 8888 [SYN] Seq=1511250602 Len=0 MSS=1460 TSV=68958042 TSER=0 WS=1
    
    Frame 1 (74 bytes on wire, 74 bytes captured)
        Arrival Time: Aug  2, 2006 15:56:01.941166000
        Frame Number: 1
        Packet Length: 74 bytes
        Capture Length: 74 bytes
        Protocols in frame: eth:ip:tcp
        Coloring Rule Name: TCP SYN/FIN
        Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
    Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
        Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
            Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
            .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
            .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
        Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
            Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
            .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
            .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
        Type: IP (0x0800)
    Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 60
        Identification: 0xedf0 (60912)
        Flags: 0x04 (Don't Fragment)
            0... = Reserved bit: Not set
            .1.. = Don't fragment: Set
            ..0. = More fragments: Not set
        Fragment offset: 0
        Time to live: 64
        Protocol: TCP (0x06)
        Header checksum: 0xfd80 (correct)
            Good: True
            Bad : False
        Source: 172.17.223.221 (172.17.223.221)
        Destination: 172.16.23.75 (172.16.23.75)
    Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250602, Len: 0
        Source port: 35530 (35530)
        Destination port: 8888 (8888)
        Sequence number: 1511250602
        Header length: 40 bytes
        Flags: 0x0002 (SYN)
            0... .... = Congestion Window Reduced (CWR): Not set
            .0.. .... = ECN-Echo: Not set
            ..0. .... = Urgent: Not set
            ...0 .... = Acknowledgment: Not set
            .... 0... = Push: Not set
            .... .0.. = Reset: Not set
            .... ..1. = Syn: Set
            .... ...0 = Fin: Not set
        Window size: 5840
        Checksum: 0xc434 (correct)
        Options: (20 bytes)
            Maximum segment size: 1460 bytes
            SACK permitted
            Time stamp: tsval 68958042, tsecr 0
            NOP
            Window scale: 1 (multiply by 2)
    
    0000  00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00   ..........8&..E.
    0010  00 3c ed f0 40 00 40 06 fd 80 ac 11 df dd ac 10   .<..@.@.........
    0020  17 4b 8a ca 22 b8 5a 13 da aa 00 00 00 00 a0 02   .K..".Z.........
    0030  16 d0 c4 34 00 00 02 04 05 b4 04 02 08 0a 04 1c   ...4............
    0040  37 5a 00 00 00 00 01 03 03 01                     7Z........
    
    No.     Time        Source                Destination           Protocol Info
          2 0.008262    172.16.23.75          172.17.223.221        TCP      8888 > 35530 [SYN, PSH, ACK] Seq=15611979 Ack=1511250603 Win=4096 Len=0 MSS=536
    
    Frame 2 (60 bytes on wire, 60 bytes captured)
        Arrival Time: Aug  2, 2006 15:56:01.949428000
        Time delta from previous packet: 0.008262000 seconds
        Time since reference or first frame: 0.008262000 seconds
        Frame Number: 2
        Packet Length: 60 bytes
        Capture Length: 60 bytes
        Protocols in frame: eth:ip:tcp
        Coloring Rule Name: TCP SYN/FIN
        Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
    Ethernet II, Src: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0), Dst: Intel_9d:38:26 (00:0e:0c:9d:38:26)
        Destination: Intel_9d:38:26 (00:0e:0c:9d:38:26)
            Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
            .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
            .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
        Source: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
            Address: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
            .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
            .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
        Type: IP (0x0800)
        Trailer: 0402
    Internet Protocol, Src: 172.16.23.75 (172.16.23.75), Dst: 172.17.223.221 (172.17.223.221)
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 44
        Identification: 0x92c4 (37572)
        Flags: 0x00
            0... = Reserved bit: Not set
            .0.. = Don't fragment: Not set
            ..0. = More fragments: Not set
        Fragment offset: 0
        Time to live: 58
        Protocol: TCP (0x06)
        Header checksum: 0x9ebd [correct]
            Good: True
            Bad : False
        Source: 172.16.23.75 (172.16.23.75)
        Destination: 172.17.223.221 (172.17.223.221)
    Transmission Control Protocol, Src Port: 8888 (8888), Dst Port: 35530 (35530), Seq: 15611979, Ack: 1511250603, Len: 0
        Source port: 8888 (8888)
        Destination port: 35530 (35530)
        Sequence number: 15611979
        Acknowledgement number: 1511250603
        Header length: 24 bytes
        Flags: 0x001a (SYN, PSH, ACK)
            0... .... = Congestion Window Reduced (CWR): Not set
            .0.. .... = ECN-Echo: Not set
            ..0. .... = Urgent: Not set
            ...1 .... = Acknowledgment: Set
            .... 1... = Push: Set
            .... .0.. = Reset: Not set
            .... ..1. = Syn: Set
            .... ...0 = Fin: Not set
        Window size: 4096
        Checksum: 0x20e5 [correct]
        Options: (4 bytes)
            Maximum segment size: 536 bytes
    
    0000  00 0e 0c 9d 38 26 00 0e d6 3a 66 c0 08 00 45 00   ....8&...:f...E.
    0010  00 2c 92 c4 00 00 3a 06 9e bd ac 10 17 4b ac 11   .,....:......K..
    0020  df dd 22 b8 8a ca 00 ee 38 4b 5a 13 da ab 60 1a   ..".....8KZ...`.
    0030  10 00 20 e5 00 00 02 04 02 18 04 02               .. .........
    
    No.     Time        Source                Destination           Protocol Info
          3 0.008276    172.17.223.221        172.16.23.75          TCP      35530 > 8888 [RST] Seq=1511250603 Len=0
    
    Frame 3 (54 bytes on wire, 54 bytes captured)
        Arrival Time: Aug  2, 2006 15:56:01.949442000
        Time delta from previous packet: 0.000014000 seconds
        Time since reference or first frame: 0.008276000 seconds
        Frame Number: 3
        Packet Length: 54 bytes
        Capture Length: 54 bytes
        Protocols in frame: eth:ip:tcp
        Coloring Rule Name: TCP RST
        Coloring Rule String: tcp.flags.reset eq 1
    Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
        Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
            Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
            .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
            .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
        Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
            Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
            .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
            .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
        Type: IP (0x0800)
    Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 40
        Identification: 0x0000 (0)
        Flags: 0x04 (Don't Fragment)
            0... = Reserved bit: Not set
            .1.. = Don't fragment: Set
            ..0. = More fragments: Not set
        Fragment offset: 0
        Time to live: 64
        Protocol: TCP (0x06)
        Header checksum: 0xeb85 (correct)
            Good: True
            Bad : False
        Source: 172.17.223.221 (172.17.223.221)
        Destination: 172.16.23.75 (172.16.23.75)
    Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250603, Len: 0
        Source port: 35530 (35530)
        Destination port: 8888 (8888)
        Sequence number: 1511250603
        Header length: 20 bytes
        Flags: 0x0004 (RST)
            0... .... = Congestion Window Reduced (CWR): Not set
            .0.. .... = ECN-Echo: Not set
            ..0. .... = Urgent: Not set
            ...0 .... = Acknowledgment: Not set
            .... 0... = Push: Not set
            .... .1.. = Reset: Set
            .... ..0. = Syn: Not set
            .... ...0 = Fin: Not set
        Window size: 0
        Checksum: 0x7e54 (correct)
    
    0000  00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00   ..........8&..E.
    0010  00 28 00 00 40 00 40 06 eb 85 ac 11 df dd ac 10   .(..@.@.........
    0020  17 4b 8a ca 22 b8 5a 13 da ab 00 00 00 00 50 04   .K..".Z.......P.
    0030  00 00 7e 54 00 00                                 ..~T..

  2. #2
    Just Joined!
    Join Date
    Apr 2009
    Posts
    1

    It is PSH flag !

    When you set PSH flag, but without any data, the connection will be reset. That why client send RST flag. I am doing PPP testing with TCP/IP, so I find this.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •