icelava.net

Hi,

Encounter some problem with my Server. To understand this require good knowledge in TCP/IP Segment and 3-way handshakes

Here is the sequence of 3-way handshakes:

1) Host B --> Host A, src port:1878 dst port: 2000
[SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1460

2) Host A --> Host B, src port: 2000, dst port: 1878
[SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=536

3) Host B --> Host A,
[TCP ZeroWindow] src port:1878 dst port:2000 [RST]
Seq=1 Ack=1576600895 Win=0 Len=0

More information:

1) Host B has not problem connecting to Host A all the while.

2) When Host C starts to download file from Host A, Host B gets connection
error

3) In packets debugging, it shows Host B send RST packets to Host A to
terminate the connection.

4) The TCP 3-way handshakes are not able to establish at all. SYN-ACK can
not be acknowledged by Host B.

If both Hosts B and C are accessing Host A for that same network service, why would Host B, which has <em>nothing</em> to do with Host C, send RST packet to Host A when Host C does something without telling Host B?

Unless Host A's software is throwing something to Host B on Host C's activity. What kinda software is this?

Host C is download files and Host B is accessing port 2000 for some service. I have no access to the application and servers. Host A is a AS/400.

From the 3-way Handshake, Host B has not yet finish the synchronisation so there is no way Host A knows what kind of files Host B want to download.

You can read RFC 3360 and RFC 793 for more information.

I suspect that the SYN packet source port initiated by Host B is dropped.
That's why whenever Host B receive Host A SYN+ACK packet, it does not know
how to react and reply a RST.

Need to find out the timeout portion.

According to this <a href="http://www.netfor2.com/tcp.htm">simple document</a> RST is a non-graceful termination of the connection (ah the memories...). If it's Host B issuing the RST then is there any log generated on why it disconnected abruptly?

yes "error:connection to x.x.x.x:xxxx timeout..."

I have established that it is the timeout due to long delay of ACK reply from Host A. Now need to find out why Host A takes so long to ACK.

<quote="spider">Now need to find out why Host A takes so long to ACK.</quote>
Buggy code? 0:-)

It's an old AS400 Server, still running on old version, probably the load cannot handle or the TCP stack is buggy.

Surprising by placing an additional network card solve the latency issue. All the existing traffic will go through this new card except for file downloading or data transfer. AS400 is a mystery to me. It is a powerful system which can run multiple platforms concurrently (Linux, Windows NT, Windows 2000 etc).

I do not want to find out why it solved the problem, unless I really want to go deep into the architect of AS400 system.