Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Multiple Syn Packets 1

Status
Not open for further replies.

younasa

Technical User
Nov 12, 2009
3
GB
Hi Experts

Was troubleshooting some network performance issues and in packet captures i saw that i am getting 2 initial syn packets when a client try to connect from internet to my web servers public address. The average latency between client and my web server is around 80 msec and These syn requests are few microseconds apart so i don't think it is due to timeout or first packets being dropped.

Example 1

641 22:03:36.305393 82.0.xx.xxx 194.xxx.xxx.xxx TCP 33334 > http [SYN] Seq=0 Win=16384 Len=0 MSS=1460
643 22:03:36.305426 82.0.xx.xxx 194.xxx.xxx.xxx TCP 33334 > http [SYN] Seq=0 Win=16384 Len=0 MSS=1460
646 22:03:36.306034 194.xxx.xxx.xxx 82.0.xx.xxx TCP http > 33334 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380
669 22:03:36.376870 82.0.xx.xxx 194.xxx.xxx.xxx TCP 33334 > http [RST] Seq=1 Win=0 Len=0
670 22:03:36.376884 82.0.xx.xxx 194.xxx.xxx.xxx TCP 33334 > http [RST] Seq=1 Win=0 Len=0

Example 2

18992 22:05:30.901642 82.34.xxx.xxx 194.xxx.xxx.xxx TCP ff-lr-port > http [SYN] Seq=0 Win=65535 Len=0 MSS=1460
18994 22:05:30.901660 82.34.xxx.xxx 194.xxx.xxx.xxx TCP ff-lr-port > http [SYN] Seq=0 Win=65535 Len=0 MSS=1460
18996 22:05:30.902738 194.xxx.xxx.xxx 82.34.xxx.xxx TCP http > ff-lr-port [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380
19496 22:05:35.233938 194.xxx.xxx.xxx 82.34.xxx.xxx TCP http > ff-lr-port [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380
19744 22:05:37.544553 194.xxx.xxx.xxx 82.34.xxx.xxx TCP http > ff-lr-port [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0



These packets are captured before any firewalls or load balancer devices. The SYN packets are 100% similar and i think my devices have no way to know which one is legitimate and which one is not, dropping one packet and replying to other but then client was expecting something else sent a RST or didn't replied.

Any expert opinions please

Regards

Adnan
 
question and problem is, Why i am getting 2 initial syns, what are the circumstances in which some one can get 2 initial syn packets few micro seconds apart.

another question is it the two initial syn which are causing the time outs and resets ?

Regards
 
looks like you are missing a packet. goes from 641 to 643 where is packet 642? does the client connect to the server? if you see this before any firewall, what is it hitting?
 
(deleted)

Now as to why they are two SYN packets, they are too quick for the web server to answer the first one right away, but it does answer both. Why? Who knows...is the server a Dell?lol

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!
 
I found the answer to my problem.
The port i am capturing is a SPAN port and it is configured to monitor my vlan for rx and tx. So I am monitoring data into my vlan from WAN and out of my vlan to LAN therefore seeing duplicate packets.

Regards
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top