---------- Forwarded message ----------
From: Eduardo Tongson <propolice@gmail.com>
Date: Feb 28, 2007 6:07 PM
Subject: Random and strange RST,ACKs
To: pf@benzedrine.cx
Hi folks,
I have this peculiar problem where the client over http is having
intermittent reset and timeouts. Doing a dump on the session I see
strange and random RST,ACKs. Here is a
snip:
No. Time Source Destination Protocol Info
54 15.291306 CLIENT SERVER TCP 4813 > 88
[ACK] Seq=2857 Ack=7738 Win=64512 Len=0
55 15.303536 CLIENT SERVER TCP 4813 > 88
[ACK] Seq=2857 Ack=9040 Win=64512 Len=0
56 15.393751 CLIENT SERVER KRB5
Continuation[Unreassembled Packet]
57 15.394190 SERVER CLIENT KRB5
Continuation[Unreassembled Packet]
58 15.482484 CLIENT SERVER TCP 4814 > 88
[ACK] Seq=2117 Ack=8350 Win=64042 Len=0
59 15.583039 CLIENT SERVER TCP 4813 > 88
[ACK] Seq=3337 Ack=9275 Win=64277 Len=0
60 17.114978 CLIENT SERVER KRB5
Continuation[Unreassembled Packet]
61 17.116075 CLIENT SERVER TCP 4814 > 88
[RST, ACK] Seq=2446 Ack=8350 Win=0 Len=0
62 17.116481 SERVER CLIENT KRB5
Continuation[Unreassembled Packet]
63 17.116585 SERVER CLIENT KRB5
Continuation[Unreassembled Packet]
64 17.116694 SERVER CLIENT KRB5
Continuation[Unreassembled Packet]
65 17.116703 SERVER CLIENT TCP [TCP segment
of a reassembled PDU]
66 17.214855 CLIENT SERVER TCP 4815 > 88
[SYN] Seq=0 Len=0 MSS=1260
67 17.215060 SERVER CLIENT TCP 88 > 4815
[SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460
on 61 there is that sudden RST,ACK.
What might cause this?
By a long shot could it be a RST attack like the one described in
"Slipping the Window"?
TIA
- ed
_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
|