For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

What_Lies_Bene1's avatar
What_Lies_Bene1
Icon for Cirrostratus rankCirrostratus
Dec 31, 2012

TCP Profile > Zero Window Timeout

Another one for you all. The TCP Profile Zero Window Timeout setting description states "If the Zero Window Timeout timer elapses, the BIG-IP system terminates the connection."   Does this mean a ...
basic
getting started
new to f5
Gladius_116564's avatar
Gladius_116564
Historic F5 Account
Aug 15, 2014

You are welcome. Yes, I tested it.

Client - 10.21.67.6

F5 - 10.21.56.71

ZeroWindow timeout - 60 secs

No.     Time                       Source                Src port Eth.Src               Destination           Dst.port Eth.DST               Protocol Length Info                                                            VLAN
     70 2014-08-12 17:17:13.319817 10.21.56.71           443      00:23:e9:87:c9:83     10.21.67.6            53552    00:22:19:65:0a:88     TCP      177    OUT s1/tmm1 : [TCP segment of a reassembled PDU]                365
     71 2014-08-12 17:17:13.320197 10.21.67.6            53552    00:22:19:65:0a:88     10.21.56.71           443      00:23:e9:87:c9:83     TCP      176    IN  s1/tmm1 : [TCP ZeroWindow] 53552 > https [ACK] Seq=169018229 Ack=3080701905 Win=0 Len=0 TSval=1645741606 TSecr=3405652008 365
   1592 2014-08-12 17:17:21.319852 10.21.56.71           443      00:23:e9:87:c9:83     10.21.67.6            53552    00:22:19:65:0a:88     TCP      177    OUT s1/tmm1 : [TCP Keep-Alive] https > 53552 [ACK] Seq=3080701905 Ack=169018229 Win=65535 Len=1 TSval=3405660008 TSecr=1645741606 365
   1593 2014-08-12 17:17:21.320186 10.21.67.6            53552    00:22:19:65:0a:88     10.21.56.71           443      00:23:e9:87:c9:83     TCP      176    IN  s1/tmm1 : [TCP ZeroWindow] 53552 > https [ACK] Seq=169018229 Ack=3080701905 Win=0 Len=0 TSval=1645749606 TSecr=3405660008 365
  11936 2014-08-12 17:17:37.320387 10.21.56.71           443      00:23:e9:87:c9:83     10.21.67.6            53552    00:22:19:65:0a:88     TCP      177    OUT s1/tmm1 : [TCP Keep-Alive] https > 53552 [ACK] Seq=3080701905 Ack=169018229 Win=65535 Len=1 TSval=3405676008 TSecr=1645749606 365
  11937 2014-08-12 17:17:37.320820 10.21.67.6            53552    00:22:19:65:0a:88     10.21.56.71           443      00:23:e9:87:c9:83     TCP      176    IN  s1/tmm1 : [TCP ZeroWindow] 53552 > https [ACK] Seq=169018229 Ack=3080701905 Win=0 Len=0 TSval=1645765607 TSecr=3405676008 365
  20939 2014-08-12 17:17:58.400352 10.21.67.6            53552    00:22:19:65:0a:88     10.21.56.71           443      00:23:e9:87:c9:83     SSLv3    199    IN  s1/tmm1 : [TCP ZeroWindow] Encrypted Alert                  365
  20940 2014-08-12 17:17:58.400373 10.21.56.71           443      00:23:e9:87:c9:83     10.21.67.6            53552    00:22:19:65:0a:88     TCP      176    OUT s1/tmm1 : [TCP Keep-Alive] https > 53552 [ACK] Seq=3080701905 Ack=169018252 Win=65535 Len=0 TSval=3405697088 TSecr=1645786686 365
  20942 2014-08-12 17:17:58.400417 10.21.56.71           443      00:23:e9:87:c9:83     10.21.67.6            53552    00:22:19:65:0a:88     TCP      176    OUT s1/tmm1 : [TCP Keep-Alive] https > 53552 [ACK] Seq=3080701905 Ack=169018253 Win=65535 Len=0 TSval=3405697088 TSecr=1645786686 365
  25132 2014-08-12 17:18:05.296199 10.21.56.71           443      00:23:e9:87:c9:83     10.21.67.6            53552    00:22:19:65:0a:88     TCP      211    https > 53552 [RST, ACK] Seq=3080701905 Ack=169018253 Win=65535 Len=0 [F5RST(peer): Flow expired (sweeper) (idle timeout)] 365
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Aug 15, 2014
    Thanks, I forgot to ask, do you have Reset on Timeout enabled in the profile please? Feel free to connect on Linkedin if you're on.