First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

TCP connection unexpected reset

Hi

We have a problem at my Bridge club where we use Android tablets to send the result of a hand to the scoring PC over wifi to an access point, then to the scoring PC. The PC then sends feedback to the tablet. Occasionally a tablet has a problem getting feedback. We find that sometimes turning wifi off and on will allow a tablet to get feedback but it usually goes wrong again soon after. The problem is random across all tablets. I captured a wireshark log at the scoring PC and it shows that a tablet that is struggling to get feedback is sending a TCP connection reset (RST) right at the start of the TCP transaction e.g. - (source port is 57727)

2136.258745 192.168.1.58 192.168.1.10 57727 -> 9000 [SYN] Seq = 0

2136.258893 192.168.10.1 192.168.1.58 9000 -> 57727 [SYN,ACK] Seq = 0

2136.354344 192.168.1.58 192.168.10.1 57727 -> 9000 [RST] Seq = 1

2137.256806 192.168.1.58 192.168.10.1 57727 -> 9000 [TCP Retransmission] Seq = 0

2137.256901 192.168.10.1 192.168.1.58 9000 -> 57727 [segment not captured, port numbers re-used]

2136.354344 192.168.1.58 192.168.10.1 57727 -> 9000 [RST] Seq = 1

Often the TCP reset comes back really fast - 3 milliseconds e.g.

2254.954148 192.168.1.58 192.168.1.10 54281 -> 9000 [SYN] Seq = 0

2254.954254 192.168.10.1 192.168.1.58 9000 -> 54281 [SYN,ACK] Seq = 0

2254.957301 192.168.1.58 192.168.10.1 54281 -> 9000 [RST] Seq = 1

I've compared the [SYN,ACK] sent by the PC against a successful one and there is no difference. Does anyone have an idea what could cause this? The tablets are Lenovo TB3 710F. The capture file is here pcap file

atom's avatar
1
atom
asked 2019-03-14 23:36:39 +0000, updated 2019-03-14 23:39:42 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

2 Answers

2

I think the problem is an ARP problem with the tablet connecting to different Access Points and the Windows server not updating its ARP cache fast enough.
Looking at the MAC conversations you will notice that the SYN_ACK gets a RESET when it is sent to a different MAC address than the source MAC address of the incoming SYN.

image description

Regards Matthias

mrEEde's avatar
4k
mrEEde
answered 2019-03-15 19:49:43 +0000, updated 2019-03-15 19:52:06 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Awesome. Thanks very much.

atom's avatar atom (2019-03-15 23:12:29 +0000) edit
more
  • delete
add a comment see more comments
0

Hi,

It is interesting that the tablet initiating the TCP connection is the device sending the TCP RST.

It could mean that the application is closing the connection because the SYN/ACK was damaged on its way from the PC to the tablet.

It could also mean the application closed the port for an unknown reason and the tablet sends the TCP RST because it is receiving a segment for a closed port.

It would be great if you could capture from the tablet's side.

If possible install your app on a PC and capture the traffic from there and the other PC at the same time to compare.

(I started playing with Bluestacks to install Android apps on my Windows PC.)

Hope this helps.

Cheers,

JF

Spooky's avatar
191
Spooky
answered 2019-03-15 01:05:13 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Thanks for the answer. I'll have another go at capturing the wifi traffic. Did you notice that after the reset the tablet tries again using the same source port. Does that suggest that the application didn't close the connection? I'll keep blustacks in mind, thanks, - the problem is that it's random which tablet the problem happens on and once it starts happening it usually goes wrong for the rest of the night so it might never show up on a laptop. Also it's difficult to use a laptop at the Bridge table as they're a bit too big.

atom's avatar atom (2019-03-15 01:20:41 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer