Revision history  [back]

I think I understand the series of events.

1. The TCP client's window is zero.
2. The TCP server sends TCP window probes because it is waiting for the client to update the window size.
3. The server sends HTTP GOAWAY to terminate the HTTP session. Afterwards, it either sends a TCP FIN or RESET

I would start Wireshark and then have the client try to duplicate the issue. When the client experiences the issue, immediately stop Wireshark and save the data to a file. If the file is large, you may have to filter for HTTP GOAWAY and then export that stream to another file. If more data is needed, the original file is available.