I am looking at an issue where two machines can't talk to each other. Server is a protprietary UNIX system with "fairly old" TCP/IP stack implementation. Client is MontaVista Linux with 2.4 kernel.
Client sends SYN, Server replies with SYN/ACK and the client immediately sends RST. I can't see anything out of whack in the TCP/IP headers. Could someone give me a clue what might be happening here? I have ran out of ideas ...
No. Time Source Destination Protocol Info
1 0.000000 172.17.223.221 172.16.23.75 TCP 35530 > 8888 [SYN] Seq=1511250602 Len=0 MSS=1460 TSV=68958042 TSER=0 WS=1
Frame 1 (74 bytes on wire, 74 bytes captured)
Arrival Time: Aug 2, 2006 15:56:01.941166000
Time delta from previous packet: 0.000000000 seconds
Time since reference or first frame: 0.000000000 seconds
Frame Number: 1
Packet Length: 74 bytes
Capture Length: 74 bytes
Protocols in frame: eth:ip:tcp
Coloring Rule Name: TCP SYN/FIN
Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0xedf0 (60912)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xfd80 [correct]
Good: True
Bad : False
Source: 172.17.223.221 (172.17.223.221)
Destination: 172.16.23.75 (172.16.23.75)
Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250602, Len: 0
Source port: 35530 (35530)
Destination port: 8888 (8888)
Sequence number: 1511250602
Header length: 40 bytes
Flags: 0x0002 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0xc434 [correct]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Time stamp: tsval 68958042, tsecr 0
NOP
Window scale: 1 (multiply by 2)
0000 00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00 ..........8&..E.
0010 00 3c ed f0 40 00 40 06 fd 80 ac 11 df dd ac 10 .<..@.@.........
0020 17 4b 8a ca 22 b8 5a 13 da aa 00 00 00 00 a0 02 .K..".Z.........
0030 16 d0 c4 34 00 00 02 04 05 b4 04 02 08 0a 04 1c ...4............
0040 37 5a 00 00 00 00 01 03 03 01 7Z........
No. Time Source Destination Protocol Info
2 0.008262 172.16.23.75 172.17.223.221 TCP 8888 > 35530 [SYN, PSH, ACK] Seq=15611979 Ack=1511250603 Win=4096 Len=0 MSS=536
Frame 2 (60 bytes on wire, 60 bytes captured)
Arrival Time: Aug 2, 2006 15:56:01.949428000
Time delta from previous packet: 0.008262000 seconds
Time since reference or first frame: 0.008262000 seconds
Frame Number: 2
Packet Length: 60 bytes
Capture Length: 60 bytes
Protocols in frame: eth:ip:tcp
Coloring Rule Name: TCP SYN/FIN
Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
Ethernet II, Src: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0), Dst: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Destination: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
Address: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Trailer: 0402
Internet Protocol, Src: 172.16.23.75 (172.16.23.75), Dst: 172.17.223.221 (172.17.223.221)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 44
Identification: 0x92c4 (37572)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x9ebd [correct]
Good: True
Bad : False
Source: 172.16.23.75 (172.16.23.75)
Destination: 172.17.223.221 (172.17.223.221)
Transmission Control Protocol, Src Port: 8888 (8888), Dst Port: 35530 (35530), Seq: 15611979, Ack: 1511250603, Len: 0
Source port: 8888 (8888)
Destination port: 35530 (35530)
Sequence number: 15611979
Acknowledgement number: 1511250603
Header length: 24 bytes
Flags: 0x001a (SYN, PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 4096
Checksum: 0x20e5 [correct]
Options: (4 bytes)
Maximum segment size: 536 bytes
0000 00 0e 0c 9d 38 26 00 0e d6 3a 66 c0 08 00 45 00 ....8&...:f...E.
0010 00 2c 92 c4 00 00 3a 06 9e bd ac 10 17 4b ac 11 .,....:......K..
0020 df dd 22 b8 8a ca 00 ee 38 4b 5a 13 da ab 60 1a ..".....8KZ...`.
0030 10 00 20 e5 00 00 02 04 02 18 04 02 .. .........
No. Time Source Destination Protocol Info
3 0.008276 172.17.223.221 172.16.23.75 TCP 35530 > 8888 [RST] Seq=1511250603 Len=0
Frame 3 (54 bytes on wire, 54 bytes captured)
Arrival Time: Aug 2, 2006 15:56:01.949442000
Time delta from previous packet: 0.000014000 seconds
Time since reference or first frame: 0.008276000 seconds
Frame Number: 3
Packet Length: 54 bytes
Capture Length: 54 bytes
Protocols in frame: eth:ip:tcp
Coloring Rule Name: TCP RST
Coloring Rule String: tcp.flags.reset eq 1
Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xeb85 [correct]
Good: True
Bad : False
Source: 172.17.223.221 (172.17.223.221)
Destination: 172.16.23.75 (172.16.23.75)
Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250603, Len: 0
Source port: 35530 (35530)
Destination port: 8888 (8888)
Sequence number: 1511250603
Header length: 20 bytes
Flags: 0x0004 (RST)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0x7e54 [correct]
0000 00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00 ..........8&..E.
0010 00 28 00 00 40 00 40 06 eb 85 ac 11 df dd ac 10 .(..@.@.........
0020 17 4b 8a ca 22 b8 5a 13 da ab 00 00 00 00 50 04 .K..".Z.......P.
0030 00 00 7e 54 00 00 ..~T..
Client sends SYN, Server replies with SYN/ACK and the client immediately sends RST. I can't see anything out of whack in the TCP/IP headers. Could someone give me a clue what might be happening here? I have ran out of ideas ...
No. Time Source Destination Protocol Info
1 0.000000 172.17.223.221 172.16.23.75 TCP 35530 > 8888 [SYN] Seq=1511250602 Len=0 MSS=1460 TSV=68958042 TSER=0 WS=1
Frame 1 (74 bytes on wire, 74 bytes captured)
Arrival Time: Aug 2, 2006 15:56:01.941166000
Time delta from previous packet: 0.000000000 seconds
Time since reference or first frame: 0.000000000 seconds
Frame Number: 1
Packet Length: 74 bytes
Capture Length: 74 bytes
Protocols in frame: eth:ip:tcp
Coloring Rule Name: TCP SYN/FIN
Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0xedf0 (60912)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xfd80 [correct]
Good: True
Bad : False
Source: 172.17.223.221 (172.17.223.221)
Destination: 172.16.23.75 (172.16.23.75)
Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250602, Len: 0
Source port: 35530 (35530)
Destination port: 8888 (8888)
Sequence number: 1511250602
Header length: 40 bytes
Flags: 0x0002 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0xc434 [correct]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Time stamp: tsval 68958042, tsecr 0
NOP
Window scale: 1 (multiply by 2)
0000 00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00 ..........8&..E.
0010 00 3c ed f0 40 00 40 06 fd 80 ac 11 df dd ac 10 .<..@.@.........
0020 17 4b 8a ca 22 b8 5a 13 da aa 00 00 00 00 a0 02 .K..".Z.........
0030 16 d0 c4 34 00 00 02 04 05 b4 04 02 08 0a 04 1c ...4............
0040 37 5a 00 00 00 00 01 03 03 01 7Z........
No. Time Source Destination Protocol Info
2 0.008262 172.16.23.75 172.17.223.221 TCP 8888 > 35530 [SYN, PSH, ACK] Seq=15611979 Ack=1511250603 Win=4096 Len=0 MSS=536
Frame 2 (60 bytes on wire, 60 bytes captured)
Arrival Time: Aug 2, 2006 15:56:01.949428000
Time delta from previous packet: 0.008262000 seconds
Time since reference or first frame: 0.008262000 seconds
Frame Number: 2
Packet Length: 60 bytes
Capture Length: 60 bytes
Protocols in frame: eth:ip:tcp
Coloring Rule Name: TCP SYN/FIN
Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1
Ethernet II, Src: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0), Dst: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Destination: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
Address: Cisco_3a:66:c0 (00:0e:d6:3a:66:c0)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Trailer: 0402
Internet Protocol, Src: 172.16.23.75 (172.16.23.75), Dst: 172.17.223.221 (172.17.223.221)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 44
Identification: 0x92c4 (37572)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x9ebd [correct]
Good: True
Bad : False
Source: 172.16.23.75 (172.16.23.75)
Destination: 172.17.223.221 (172.17.223.221)
Transmission Control Protocol, Src Port: 8888 (8888), Dst Port: 35530 (35530), Seq: 15611979, Ack: 1511250603, Len: 0
Source port: 8888 (8888)
Destination port: 35530 (35530)
Sequence number: 15611979
Acknowledgement number: 1511250603
Header length: 24 bytes
Flags: 0x001a (SYN, PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 4096
Checksum: 0x20e5 [correct]
Options: (4 bytes)
Maximum segment size: 536 bytes
0000 00 0e 0c 9d 38 26 00 0e d6 3a 66 c0 08 00 45 00 ....8&...:f...E.
0010 00 2c 92 c4 00 00 3a 06 9e bd ac 10 17 4b ac 11 .,....:......K..
0020 df dd 22 b8 8a ca 00 ee 38 4b 5a 13 da ab 60 1a ..".....8KZ...`.
0030 10 00 20 e5 00 00 02 04 02 18 04 02 .. .........
No. Time Source Destination Protocol Info
3 0.008276 172.17.223.221 172.16.23.75 TCP 35530 > 8888 [RST] Seq=1511250603 Len=0
Frame 3 (54 bytes on wire, 54 bytes captured)
Arrival Time: Aug 2, 2006 15:56:01.949442000
Time delta from previous packet: 0.000014000 seconds
Time since reference or first frame: 0.008276000 seconds
Frame Number: 3
Packet Length: 54 bytes
Capture Length: 54 bytes
Protocols in frame: eth:ip:tcp
Coloring Rule Name: TCP RST
Coloring Rule String: tcp.flags.reset eq 1
Ethernet II, Src: Intel_9d:38:26 (00:0e:0c:9d:38:26), Dst: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Destination: All-HSRP-routers_11 (00:00:0c:07:ac:11)
Address: All-HSRP-routers_11 (00:00:0c:07:ac:11)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Intel_9d:38:26 (00:0e:0c:9d:38:26)
Address: Intel_9d:38:26 (00:0e:0c:9d:38:26)
.... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
.... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 172.17.223.221 (172.17.223.221), Dst: 172.16.23.75 (172.16.23.75)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xeb85 [correct]
Good: True
Bad : False
Source: 172.17.223.221 (172.17.223.221)
Destination: 172.16.23.75 (172.16.23.75)
Transmission Control Protocol, Src Port: 35530 (35530), Dst Port: 8888 (8888), Seq: 1511250603, Len: 0
Source port: 35530 (35530)
Destination port: 8888 (8888)
Sequence number: 1511250603
Header length: 20 bytes
Flags: 0x0004 (RST)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0x7e54 [correct]
0000 00 00 0c 07 ac 11 00 0e 0c 9d 38 26 08 00 45 00 ..........8&..E.
0010 00 28 00 00 40 00 40 06 eb 85 ac 11 df dd ac 10 .(..@.@.........
0020 17 4b 8a ca 22 b8 5a 13 da ab 00 00 00 00 50 04 .K..".Z.......P.
0030 00 00 7e 54 00 00 ..~T..