Need opinions

[jdel]

Hey all. Just thought I'd try to pick your brains for advice. We are having a strange issue at a customer site. They are running an application that sends a file to us, but every time they do it fails after roughly an hour. In doing packet captures we've seen 2 results on 2 separate occaisions.
1) there was a full 3-way handshake, the transfer began as normal, but then in the middle of the transfer the workstaion sent a FIN packet, ending the transmission before it was done.
2) on the next trial, there was no SYN packet sent at all (confirmed in our firewall logs), and therefore in trying to reach the destination there was several retransmissions and eventually the app just died.

anyone got any ideas? we're quickly running low on our own! Thank you.

 

[wybnormal]

I've seen this where the application is controlling the timing and handshaking. When the application loses the control and/or timing, you lose the connection. My last case of this was with WaveLink which is a RF scanner "middleware" application that talks to RF scanner guns by TCP and a custom port number. Under a load it would not be able to keep up with the inbound traffic and one of the connections would fall out of sync.

MikeS


Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu