Forum Discussion

Zara_117183's avatar
Zara_117183
Icon for Nimbostratus rankNimbostratus
Mar 04, 2016

TCP RST sent after closing connection

Hi, I use this http monitor GET /healthcheck.html HTTP/1.1\r\nHost: \r\nConnection: Close\r\n\r\n but sometimes the Big-IP send a RST packet to the server after closing connection. packet captu...
http monitor
LTM
security
tcp rst
Zara_117183's avatar
Zara_117183
Icon for Nimbostratus rankNimbostratus
Mar 07, 2016

Hi farukaydin, Y're right.. here are two packet capture for the same session

Big-IP Side:
"12","5.221353","30.106.21.249","30.106.28.1","TCP","158","OUT s1/tmm0 : 32873 > http [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=1349922501 TSecr=0 WS=128"
"13","5.221648","30.106.28.1","30.106.21.249","TCP","162","IN  s1/tmm0 : http > 32873 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=8 SACK_PERM=1 TSval=865996206 TSecr=1349922501"
"14","5.222300","30.106.21.249","30.106.28.1","TCP","150","OUT s1/tmm0 : 32873 > http [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=1349922502 TSecr=865996206"
"15","5.222306","30.106.21.249","30.106.28.1","HTTP","230","OUT s1/tmm0 : GET /healthcheck.html HTTP/1.1 "
"16","5.222625","30.106.28.1","30.106.21.249","TCP","150","IN  s1/tmm0 : http > 32873 [ACK] Seq=1 Ack=81 Win=263456 Len=0 TSval=865996206 TSecr=1349922502"
"17","5.223896","30.106.28.1","30.106.21.249","HTTP","478","IN  s1/tmm0 : HTTP/1.1 200 OK  (text/html)"
"18","5.223900","30.106.28.1","30.106.21.249","TCP","150","IN  s1/tmm0 : http > 32873 [FIN, PSH, ACK] Seq=329 Ack=81 Win=263456 Len=0 TSval=865996206 TSecr=1349922502"
"19","5.224589","30.106.21.249","30.106.28.1","TCP","150","OUT s1/tmm0 : 32873 > http [ACK] Seq=81 Ack=329 Win=15744 Len=0 TSval=1349922504 TSecr=865996206"
"20","5.224593","30.106.21.249","30.106.28.1","TCP","150","OUT s1/tmm0 : 32873 > http [FIN, ACK] Seq=81 Ack=330 Win=15744 Len=0 TSval=1349922504 TSecr=865996206"
"21","5.224924","30.106.28.1","30.106.21.249","TCP","150","IN  s1/tmm0 : http > 32873 [ACK] Seq=330 Ack=82 Win=263448 Len=0 TSval=865996206 TSecr=1349922504"
"22","5.224929","30.106.28.1","30.106.21.249","TCP","150","IN  s1/tmm0 : [TCP Dup ACK 211] http > 32873 [ACK] Seq=330 Ack=82 Win=263448 Len=0 TSval=865996206 TSecr=1349922504"
"23","5.225013","30.106.21.249","30.106.28.1","TCP","206","OUT s1/tmm0 : 32873 > http [RST, ACK] Seq=82 Ack=330 Win=0 Len=42 [F5RST: TCP 3WHS rejected]"

Server Side:

"31","6.02267","30.106.21.249","30.106.28.1","TCP","78","32873 > http [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=101969907 TSecr=0 WS=128"
"32","6.022181","30.106.28.1","30.106.21.249","TCP","82","http > 32873 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=8 SACK_PERM=1 TSval=535246142 TSecr=101969907"
"33","6.023085","30.106.21.249","30.106.28.1","TCP","70","32873 > http [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=101969907 TSecr=535246142"
"34","6.023093","30.106.21.249","30.106.28.1","HTTP","60","GET /healthcheck.html HTTP/1.1 "
"35","6.023098","30.106.28.1","30.106.21.249","TCP","70","http > 32873 [ACK] Seq=1 Ack=81 Win=263456 Len=0 TSval=535246142 TSecr=101969907"
"36","6.024074","30.106.28.1","30.106.21.249","HTTP","398","HTTP/1.1 200 OK  (text/html)"
"37","6.024091","30.106.28.1","30.106.21.249","TCP","70","http > 32873 [FIN, PSH, ACK] Seq=329 Ack=81 Win=263456 Len=0 TSval=535246142 TSecr=101969907"
"38","6.025204","30.106.21.249","30.106.28.1","TCP","70","32873 > http [FIN, ACK] Seq=81 Ack=330 Win=6744 Len=0 TSval=101969909 TSecr=535246142"
"39","6.025214","30.106.28.1","30.106.21.249","TCP","70","http > 32873 [ACK] Seq=330 Ack=82 Win=263448 Len=0 TSval=535246142 TSecr=101969909"
"40","6.025216","30.106.21.249","30.106.28.1","TCP","70","[TCP Keep-Alive] 32873 > http [ACK] Seq=81 Ack=329 Win=6744 Len=0 TSval=101969909 TSecr=535246142"
"41","6.025220","30.106.28.1","30.106.21.249","TCP","70","[TCP Keep-Alive ACK] http > 32873 [ACK] Seq=330 Ack=82 Win=263448 Len=0 TSval=535246142 TSecr=101969909"
"42","6.025719","30.106.21.249","30.106.28.1","TCP","100","32873 > http [RST, ACK] Seq=82 Ack=330 Win=0 Len=42"

Thank you for your help. Zara