1

My company develops and sells a system where one or more client devices are deployed in the customer's network, and they establish two websocket (TCP) connections on port 443 to the cloud server.

This setup has worked just fine for a while on various locations with different network topologies, firewalls, restrictions, behind double NATs, etc.

The problem arose at one customer where devices couldn't establish both connections: during boot, the device establishes one websocket connection (from one application), and a few seconds later, another one (from the second application). At this customer, after establishing second connection, the first one drops out.

I won't go too much into details about unproductive e-mails and a failed meeting where they called us out for our "lack of knowledge". I'll just say that they were surprised that we even expected this to work (it does on dozens of other locations behind other firewalls, VLANs and NATs, both in testing and production) and we listened to a deficient explanation of why it can't work - basically, their "explanation" was:

IP and port pair make up a "socket", and since one connection uses that socket, there can't possibly exist two connections to that same socket at the same time. Firewall sees that a connection to the "socket" already exists and it doesn't pass the new one through, so only one remains. This is the normal, usual firewall behavior, and if it works on other locations, it's just because you don't use firewall there.

They left out the fact that "socket" exists on both sides: source and destination, and that two apps use two different source ports to make a connection, and that firewall uses source socket as well to identify the connection, not just the destination socket.

When asked about the issues when browsing the web on other clients in the network (modern web page can cause the browser to make dozens of connections, which could make normal surfing very slow in case of large files, and impossible if a big file was being downloaded from the same server), we got, literally, a technobabble explanation which nobody understood.

In the end, for various reasons, which include not arguing with a bunch of old-school stubborn network "engineers", we accepted their solution - connections will have two separate ports, and they promised that it will work.

My question is: what limits the number of connections a single client can establish to some IP and port to one connection only? We can't get detailed network details and topology, but regardless of the firewall type (hardware, software, dedicated machine, running on router), isn't making multiple connections to the same IP:port such a basic requirement that someone would have to actively and intentionally block it?

Are we really "incompetent", or are we being deceived, either intentionally or unintentionally?

5
  • Unfortunately, questions about networks not under your direct control are off-topic here. We would need to know a lot more information: a good network description or diagram, the network device models, the network device configurations, logs/debugs, etc. Speculation and guessing are off-topic here.
    – Ron Maupin
    Oct 19, 2018 at 14:45
  • Welcome Blagus. You are correct, it is completely usual to have multiple simultaneous TCP connections between two hosts, which differ only in the port on one side. A typical example is simultaneous fetching of images for a web page from a single host. (Search for tcp 4-tuple, or see RFC 793 p5.) I suggest you reword your question to be more clearly about TCP theory if you want to ask more here; I've voted to reopen in any case. Sadly, when interoperability fails, everybody points at the other side, and it takes goodwill and cooperation to solve.
    – jonathanjo
    Oct 19, 2018 at 14:58
  • @RonMaupin What would be the better place to ask this? Serverfault, Stackoverflow?
    – Blagus
    Oct 19, 2018 at 15:09
  • @jonathanjo I see now that this is not the best site in SE network to ask this. I'll ask elsewhere, but thanks anyway.
    – Blagus
    Oct 19, 2018 at 15:10
  • Without enough information to be able to answer the question, I don't know of an SE site that may not consider the question to be too broad. You could try to hold a discussion on the chat for an SE site. Unfortunately, you do not seem to have enough reputation to participate in Network Engineering Chat.
    – Ron Maupin
    Oct 19, 2018 at 15:12

0

Browse other questions tagged or ask your own question.