1

I'm trying to set up a modbus TCP connection on port 502 but get a RST packet immediatly. So the TCP connection handshake doesn't even succeed. This is done on a windows machine on an ESX server. The ESX server is connected to a Cisco 2960 switch and the modbus device to the same switch.

Wireshark capture: enter image description here

When I just use a laptop and a simple unmanaged D-Link switch the connection works.

I've completely reset the Cisco switch already but that doesn't help.

I've tried to use the command below as well as several debug commands on the Cisco switch:

ip tcp synwait-time 300

But that doesn't help. Are there any Cisco IOS debug commands where I can see the cause of this error?

I'm also not sure if the issue is in the Cisco switch or the vmware switch/firewall... It's probably in one of them since it works with a laptop and another switch.

The source MAC address of the RST packet is the modbus device...

Note: the modbus device also has a webinterface on TCP port 80 which works, so other TCP connections are OK...

Does anyone have any pointers or ideas to solve this issue?

Thanks!

Robbe

Improve this question
6
  • Does the laptop also connect to TCP port 502? What happens when you connect the laptop to the Cisco switch? What happens when you connect the ESXi server to the DLINK switch? In the web interface of the modbus device is there any settings like access control which limit who can connect?
    – hertitu
    Nov 26, 2019 at 16:42
  • 1
    RST is generated by TCP in the host/server, but what a host/server does in off-topic here. We can look at the Cisco switch configuration if you edit the question to include it, but the switch doesn't get involved in anything like TCP.
    – Ron Maupin ♦
    Nov 26, 2019 at 16:46
  • An ESXi standad vSwitch doesn't have any firewall/filtering function. What is the config on the physical switch? Any ACLs? Any source IP restriction on the destination device?
    – Zac67 ♦
    Nov 26, 2019 at 16:46
  • Thanks all for the replies. The laptop also connects via port 502. The switch is indeed only L2 so that can't be the cause... There aren't any ACL's configured. The webinterface of the modbus device also doesn't have any access settings. Had contact with the manufacturer of the modbus device by now, they were able to recreate the issue. In the end they "solved" it by setting the modbus device to DHCP instead of a fixed IP. Very strange since there weren't any other problems... Guess I'll need to check this further with the manufacturer.
    – RobbeM
    Nov 27, 2019 at 8:51
  • Seen exactly this behaviors and it turned out to be a Cisco waas box that was configured with wrong IP, those accelerators intercepts traffic in ways that are not always obvious
    – Matt Douhan
    Dec 7, 2019 at 20:58

1 Answer 1

Reset to default
0

If you suspect something on the switch you can simply do a SPAN capture using your PC to check the ingress and egress traffic, but the switch does not care much if that is a tcp/udp or what type of traffic it is. Unless you have any policies configured on it. I suppose this VM could have some FW settings, I think you can check for something similar to the TCP packet inspection.

Regards,

VSL

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.