THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 2
grahamb's avatar
23.8k
grahamb
updated 2021-08-10 12:50:49 +0000

Application Hangs, Need help with packet Analysis

Hi,

I am troubleshooting an issue with an POS\Restaurant application that is hanging and has slow performance. Vendor had me send the a packet capture from one of the terminals. They are saying it looks like the firewall is causing the disconnects with the hosted system, but for troubleshooting we have firewall wide open. Can someone take a look at the following stream and let me know if it looks like the firewall would be causing an issue? To me, it looks like the terminal (10.215.50.101) is sending the RST after the communication was ended with a FIN packet and the server tried to send Encrypted Alert. I'm just not the greatest at Analysis.

 1.  10.215.50.101  64.79.134.26    TCP 66  61398 → 443 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256
 2.  10.215.50.101  64.79.134.26    TCP 66  61398 → 443 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256
 3.  10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [ACK] Seq=1 Ack=1 Win=66048 Len=0
 4.  10.215.50.101  64.79.134.26    TLSv1.2 426 Client Hello
 5.  64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [ACK] Seq=1 Ack=373 Win=15872 Len=0
 6.  64.79.134.26   10.215.50.101   TLSv1.2 163 Server Hello, Change Cipher Spec, Encrypted Handshake
 7.  10.215.50.101  64.79.134.26    TLSv1.2 575 Change Cipher Spec, Encrypted Handshake Message
 8.  64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [ACK] Seq=110 Ack=894 Win=16896 Len=0
 9. 10.215.50.101   64.79.134.26    TLSv1.2 464 Application Data
 10. 64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [ACK] Seq=110 Ack=1304 Win=17920 Len=0
 11. 64.79.134.26   10.215.50.101   TLSv1.2 436 Application Data
 12. 64.79.134.26   10.215.50.101   TLSv1.2 612 Application Data
 13. 10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [ACK] Seq=1304 Ack=1050 Win=65024 Len=0
 14. 10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [FIN, ACK] Seq=1304 Ack=1050 Win=65024 Len=0
 15. 64.79.134.26   10.215.50.101   TLSv1.2 85  Encrypted Alert
 16. 10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [RST, ACK] Seq=1305 Ack=1081 Win=0 Len=0
 17. 64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [FIN, ACK] Seq=1081 Ack=1305 Win=17920 Len=0

Thanks in advance!

Revision 1
jjosh823's avatar
1
jjosh823
asked 2021-08-10 12:15:22 +0000

Application Hangs, Need help with packet Analysis

Hi,

I am troubleshooting an issue with an POS\Restaurant application that is hanging and has slow performance. Vendor had me send the a packet capture from one of the terminals. They are saying it looks like the firewall is causing the disconnects with the hosted system, but for troubleshooting we have firewall wide open. Can someone take a look at the following stream and let me know if it looks like the firewall would be causing an issue? To me, it looks like the terminal (10.215.50.101) is sending the RST after the communication was ended with a FIN packet and the server tried to send Encrypted Alert. I'm just not the greatest at Analysis.

 1.  
     
  1. 10.215.50.101  64.79.134.26    TCP 66  61398 → 443 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256
 2.  WS=256
    2.  
  2. 10.215.50.101  64.79.134.26    TCP 66  61398 → 443 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256
 3.  WS=256
    3.  
  3. 10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [ACK] Seq=1 Ack=1 Win=66048 Len=0
 4.  Len=0
    4.  
  4. 10.215.50.101  64.79.134.26    TLSv1.2 426 Client Hello
 5.  Hello
    5.  
  5. 64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [ACK] Seq=1 Ack=373 Win=15872 Len=0
 6.  Len=0
    6.  
  6. 64.79.134.26   10.215.50.101   TLSv1.2 163 Server Hello, Change Cipher Spec, Encrypted Handshake
 7.  Handshake
    7.  
  7. 10.215.50.101  64.79.134.26    TLSv1.2 575 Change Cipher Spec, Encrypted Handshake Message
 8.  Message
    8.  
  8. 64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [ACK] Seq=110 Ack=894 Win=16896 Len=0
 9. Len=0
    9.  
  9. 10.215.50.101   64.79.134.26    TLSv1.2 464 Application Data
 10. Data
    10.  
  10. 64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [ACK] Seq=110 Ack=1304 Win=17920 Len=0
 11. Len=0
    11.  
  11. 64.79.134.26   10.215.50.101   TLSv1.2 436 Application Data
 12. Data
    12.  
  12. 64.79.134.26   10.215.50.101   TLSv1.2 612 Application Data
 13. Data
    13.  
  13. 10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [ACK] Seq=1304 Ack=1050 Win=65024 Len=0
 14. Len=0
    14.  
  14. 10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [FIN, ACK] Seq=1304 Ack=1050 Win=65024 Len=0
 15. Len=0
    15.  
  15. 64.79.134.26   10.215.50.101   TLSv1.2 85  Encrypted Alert
 16. Alert
    16.  
  16. 10.215.50.101  64.79.134.26    TCP 54  61398 → 443 [RST, ACK] Seq=1305 Ack=1081 Win=0 Len=0
 17. Len=0
    17.  
  17. 64.79.134.26   10.215.50.101   TCP 60  443 → 61398 [FIN, ACK] Seq=1081 Ack=1305 Win=17920 Len=0
Len=0

Thanks in advance!