Find the answer to your Linux question:
Results 1 to 2 of 2
I am looking at an issue where two machines can't talk to each other. Server is a protprietary UNIX system with "fairly old" TCP/IP stack implementation. Client is MontaVista Linux ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. 08-03-2006 #1
    PoketAces
    PoketAces is offline
    Just Joined!
    Join Date
    Aug 2006
    Posts
    1

    PROBLEM - TCP client send RST after SYN/ACK

    I am looking at an issue where two machines can't talk to each other. Server is a protprietary UNIX system with "fairly old" TCP/IP stack implementation. Client is MontaVista Linux with 2.4 kernel.

    Client sends SYN, Server replies with SYN/ACK and the client immediately sends RST. I can't see anything out of whack in the TCP/IP headers. Could someone give me a clue what might be happening here? I have ran out of ideas ...

    Code:
    No.     Time        Source                Destination           Protocol Info
      1 0.000000    172.17.223.221        172.16.23.75          TCP      35530 > 8888 [SYN] Seq=1511250602 Len=0 MSS=1460 TSV=68958042 TSER=0 WS=1

Frame 1 (74 bytes on wire, 74 bytes captured)
    Arrival Time: Aug  2, 2006 15:56:01.941166000
    Frame Number: 1
    Packet Length: 74 bytes
    Capture Length: 74 bytes
    Protocols in frame: eth:ip:tcp
    Coloring Rule Name: TCP SYN/FIN
    Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
    Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
        Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
    Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
        Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
    Type: IP (0x0800)
Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 60
    Identification: 0xedf0 (60912)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (0x06)
    Header checksum: 0xfd80 (correct)
        Good: True
        Bad : False
    Source: 172.17.223.221 (172.17.223.221)
    Destination: 172.16.23.75 (172.16.23.75)
Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250602, Len: 0
    Source port: 35530 (35530)
    Destination port: 8888 (8888)
    Sequence number: 1511250602
    Header length: 40 bytes
    Flags: 0x0002 (SYN)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..1. = Syn: Set
        .... ...0 = Fin: Not set
    Window size: 5840
    Checksum: 0xc434 (correct)
    Options: (20 bytes)
        Maximum segment size: 1460 bytes
        SACK permitted
        Time stamp: tsval 68958042, tsecr 0
        NOP
        Window scale: 1 (multiply by 2)

0000  00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00   ..........8&..E.
0010  00 3c ed f0 40 00 40 06 fd 80 ac 11 df dd ac 10   .<..@.@.........
0020  17 4b 8a ca 22 b8 5a 13 da aa 00 00 00 00 a0 02   .K..".Z.........
0030  16 d0 c4 34 00 00 02 04 05 b4 04 02 08 0a 04 1c   ...4............
0040  37 5a 00 00 00 00 01 03 03 01                     7Z........

No.     Time        Source                Destination           Protocol Info
      2 0.008262    172.16.23.75          172.17.223.221        TCP      8888 > 35530 [SYN, PSH, ACK] Seq=15611979 Ack=1511250603 Win=4096 Len=0 MSS=536

Frame 2 (60 bytes on wire, 60 bytes captured)
    Arrival Time: Aug  2, 2006 15:56:01.949428000
    Time delta from previous packet: 0.008262000 seconds
    Time since reference or first frame: 0.008262000 seconds
    Frame Number: 2
    Packet Length: 60 bytes
    Capture Length: 60 bytes
    Protocols in frame: eth:ip:tcp
    Coloring Rule Name: TCP SYN/FIN
    Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
Ethernet II, Src: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0), Dst: Intel_9d:38:26 (00:0e:0c:9d:38:26)
    Destination: Intel_9d:38:26 (00:0e:0c:9d:38:26)
        Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
    Source: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
        Address: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
    Type: IP (0x0800)
    Trailer: 0402
Internet Protocol, Src: 172.16.23.75 (172.16.23.75), Dst: 172.17.223.221 (172.17.223.221)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 44
    Identification: 0x92c4 (37572)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 58
    Protocol: TCP (0x06)
    Header checksum: 0x9ebd [correct]
        Good: True
        Bad : False
    Source: 172.16.23.75 (172.16.23.75)
    Destination: 172.17.223.221 (172.17.223.221)
Transmission Control Protocol, Src Port: 8888 (8888), Dst Port: 35530 (35530), Seq: 15611979, Ack: 1511250603, Len: 0
    Source port: 8888 (8888)
    Destination port: 35530 (35530)
    Sequence number: 15611979
    Acknowledgement number: 1511250603
    Header length: 24 bytes
    Flags: 0x001a (SYN, PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..1. = Syn: Set
        .... ...0 = Fin: Not set
    Window size: 4096
    Checksum: 0x20e5 [correct]
    Options: (4 bytes)
        Maximum segment size: 536 bytes

0000  00 0e 0c 9d 38 26 00 0e d6 3a 66 c0 08 00 45 00   ....8&...:f...E.
0010  00 2c 92 c4 00 00 3a 06 9e bd ac 10 17 4b ac 11   .,....:......K..
0020  df dd 22 b8 8a ca 00 ee 38 4b 5a 13 da ab 60 1a   ..".....8KZ...`.
0030  10 00 20 e5 00 00 02 04 02 18 04 02               .. .........

No.     Time        Source                Destination           Protocol Info
      3 0.008276    172.17.223.221        172.16.23.75          TCP      35530 > 8888 [RST] Seq=1511250603 Len=0

Frame 3 (54 bytes on wire, 54 bytes captured)
    Arrival Time: Aug  2, 2006 15:56:01.949442000
    Time delta from previous packet: 0.000014000 seconds
    Time since reference or first frame: 0.008276000 seconds
    Frame Number: 3
    Packet Length: 54 bytes
    Capture Length: 54 bytes
    Protocols in frame: eth:ip:tcp
    Coloring Rule Name: TCP RST
    Coloring Rule String: tcp.flags.reset eq 1
Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
    Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
        Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
    Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
        Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
    Type: IP (0x0800)
Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0x0000 (0)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (0x06)
    Header checksum: 0xeb85 (correct)
        Good: True
        Bad : False
    Source: 172.17.223.221 (172.17.223.221)
    Destination: 172.16.23.75 (172.16.23.75)
Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250603, Len: 0
    Source port: 35530 (35530)
    Destination port: 8888 (8888)
    Sequence number: 1511250603
    Header length: 20 bytes
    Flags: 0x0004 (RST)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .1.. = Reset: Set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 0
    Checksum: 0x7e54 (correct)

0000  00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00   ..........8&..E.
0010  00 28 00 00 40 00 40 06 eb 85 ac 11 df dd ac 10   .(..@.@.........
0020  17 4b 8a ca 22 b8 5a 13 da ab 00 00 00 00 50 04   .K..".Z.......P.
0030  00 00 7e 54 00 00                                 ..~T..
    Reply With Quote Reply With Quote
  2. 04-28-2009 #2
    forest_luo
    forest_luo is offline
    Just Joined!
    Join Date
    Apr 2009
    Posts
    1

    It is PSH flag !

    When you set PSH flag, but without any data, the connection will be reset. That why client send RST flag. I am doing PPP testing with TCP/IP, so I find this.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules