We are seeing TCP connections sporadically fail to establish, when a bandwidth limiter is placed on the network regardless of whether the limit is being hit.

Below are links to some packet captures which demonstrate this, when connecting to an arbitrary TCP service. One capture shows a working connection and the other a failed connection. There are also two of a failed connection, taken from client and server side.

The service seems irrelevant here - we've tried connecting to different TCP services on the server.

The captures show the server sending a RST to the client, after it has received the ACK.

What is causing the server to send the RST, in the failed example?

PCAP links are:

By request, here is a pcap taken on both client and server during a single failed connection:

  • what is the bandwidth limiter? – Ron Trunk Aug 31 '16 at 22:38
  • Where were the captures taken, on the client (or between client and limiter) or on the server (or between limiter and server)? Could you get simultaneous client and server side captures of a failing connection? The reason I'm asking is because it might be the limiter sending the RST ? – hertitu Aug 31 '16 at 22:49
  • Captures were taken on the server. I've taken captures on the client and the limiter - they all look the same. It is most certainly the server that is sending the RST. – phil-lavin Sep 1 '16 at 7:31
  • The limiter here is pfSense – phil-lavin Sep 1 '16 at 7:32
  • 1
    I was breaking my head over this as I really couldn't see anything wrong with the ACK, so I'm glad you found the cause so fast :) Now, you can't see whether SYN cookies are used, the 'cookie' is really the initial SEQ value in the SYN+ACK. If you want to dig deeper into this would you mind posting a client and server capture of the same failed connection please? Also: was the "working" pcap taken without the limiter in place? Edit: it seems you removed your comment about the SYN cookies while I was writing my comment? – hertitu Sep 1 '16 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.