Yup there is a firewall. But the connection is not idle. Those RST,
ACKs appear during the session.
On 3/2/07, Phil Hunter <1860ph@gmail.com> wrote:
> Eduardo Tongson wrote:
> > ---------- Forwarded message ----------
> > From: Eduardo Tongson <propolice@gmail.com>
> > Date: Feb 28, 2007 6:07 PM
> > Subject: Random and strange RST,ACKs
> > To: pf@benzedrine.cx
> > Hi folks,
> > I have this peculiar problem where the client over http is having
> > intermittent reset and timeouts. Doing a dump on the session I see
> > strange and random RST,ACKs. Here is a
> > snip:
> >
> > No. Time Source Destination Protocol Info
> > 54 15.291306 CLIENT SERVER TCP 4813 > 88
> > [ACK] Seq=2857 Ack=7738 Win=64512 Len=0
> > 55 15.303536 CLIENT SERVER TCP 4813 > 88
> > [ACK] Seq=2857 Ack=9040 Win=64512 Len=0
> > 56 15.393751 CLIENT SERVER KRB5
> > Continuation[Unreassembled Packet]
> > 57 15.394190 SERVER CLIENT KRB5
> > Continuation[Unreassembled Packet]
> > 58 15.482484 CLIENT SERVER TCP 4814 > 88
> > [ACK] Seq=2117 Ack=8350 Win=64042 Len=0
> > 59 15.583039 CLIENT SERVER TCP 4813 > 88
> > [ACK] Seq=3337 Ack=9275 Win=64277 Len=0
> > 60 17.114978 CLIENT SERVER KRB5
> > Continuation[Unreassembled Packet]
> > 61 17.116075 CLIENT SERVER TCP 4814 > 88
> > [RST, ACK] Seq=2446 Ack=8350 Win=0 Len=0
> > 62 17.116481 SERVER CLIENT KRB5
> > Continuation[Unreassembled Packet]
> > 63 17.116585 SERVER CLIENT KRB5
> > Continuation[Unreassembled Packet]
> > 64 17.116694 SERVER CLIENT KRB5
> > Continuation[Unreassembled Packet]
> > 65 17.116703 SERVER CLIENT TCP [TCP segment
> > of a reassembled PDU]
> > 66 17.214855 CLIENT SERVER TCP 4815 > 88
> > [SYN] Seq=0 Len=0 MSS=1260
> > 67 17.215060 SERVER CLIENT TCP 88 > 4815
> > [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460
> >
> > on 61 there is that sudden RST,ACK.
> >
> > What might cause this?
> > By a long shot could it be a RST attack like the one described in
> > "Slipping the Window"?
> >
> > TIA
> > - ed
> > _______________________________________________
> > firewall-wizards mailing list
> > firewall-wizards@listserv.icsalabs.com
> > https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
> >
> >
> Is there a firewall between these. If so it will reset the connection
> every two hours if not used
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@listserv.icsalabs.com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>
_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
|