Re: HTTP intermittent daily failures, only between 4:02:30 thru 4:04:30

Hello Paul,

Am 16.03.2020 um 19:06 schrieb Steinmetz, Paul via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>:

From a WireShark pcap trace run from the I, IBM confirmed that RST flag is being set, from the remote IP, causing the connection to reset/close.

We've been unable to determine the cause the RST.

This might be caused by an unhappy firewall appliance either at your or the peer's side.

What process and where would this be running for this brief two minutes window (4:02:30 thru 4:04:30) that would cause RST, reset/closing the connection.

That's a good question. I experienced stuff like this with Cisco ASAs when they ran out of their (hardware defined) maximum connections.

See also: https://www.pico.net/kb/what-is-a-tcp-reset-rst

Unexpected packet (aka: protocol violation) smells even more like firewall. I'd check local and remote's logs for clues. Maybe it could be necessary to enable a more detailed debug mode for the given time frame to provide more information.

:wq! PoC

PGP-Key: DDD3 4ABF 6413 38DE - https://www.pocnet.net/poc-key.asc