# Wireshark capture - Random Reset Packets



## ThePistonDoctor (Mar 2, 2009)

Hi all - 

I have a system on my network running Agile Advantage, a product lifecycle management package. on 11/15 it started randomly disconnecting users at one of my locations. They will be able to stay on for between 5 and 30 minutes, but then will be disconnected with the message "Lost connection with server, the application will now close." And then they will be asked to reconnect which works fine for another 5-30 minutes.

I did some investigation and discovered that the server (192.168.173.18) is sending random reset packets to the 10.0.0.0/24 subnet. Investigating the reset packet more closely, I found that it is being sent because the last step of the three-way handshake is not being completed. 

In the attached capture you can see the SYN from 10.0.0.73, then a SYN/ACK from 192.168.173.18, then an ACK from 10.0.0.73 followed by a PSH/ACK from 10.0.0.73 (indicating it didn't go through). Then the 192.168.173.18 server sends another ACK and the process continues. It tries a few times, then finally gives up and sends a reset packet which disconnects the user. 

I have run wireshark from the server but unfortunately the NAT translation makes it difficult for me to filter capture results to provide anything useful. This scan is from a workstation which is being disconnected regularly from the Agile server. 

Any idea what might be causing this, or ideas on how to troubleshoot such an issue? Thanks!

EDIT: I couldn't figure out how to save ONLY the filtered packets as a separate capture file, so in the interest of saving everyone else's time I've provided a screenshot instead. If more info is needed please let me know and I will attach the entire capture file.


----------



## scottsee (Feb 28, 2007)

Wireshark can be a little hard to use from time to time, don't feel bad. When you have a display filter in place you need to use Edit>Mark All Displayed Packets. Then in the Save-as there is a Packet Range box, click Displayed and Marked Packets radio buttons. That will take care of the Display Filter packets.

Send it to my PM..

Is this happening to everyone connected to this service? Or only this specific client?


----------



## ThePistonDoctor (Mar 2, 2009)

Thanks Scottsee! That's exactly what I was looking for. I've attached the file here in zip format for everyone to see (I didn't see a place to add an attachment via a PM). And yes, it is happening to all clients on the 10.0.0.0/24 subnet. The 192.168.160.0/19 subnet (the one local to that server) is fine, so I suspect it might be something between the sites. 

We do have an MPLS connection set up, so it could be something on the MPLS router blocking the packets too. I prefer not to hand out the information about our MPLS router unless required though, so let's take it step by step and see if there's anything in this dump first. 

Thanks!


----------



## ThePistonDoctor (Mar 2, 2009)

If anyone's got any ideas, I'm actually still looking for a solution to this. I am working on getting access to Oracle's knowledge base as well but figured I'd bump this up in case anyone has any ideas. 

I know the capture doesn't give much, but has anyone seen activity like this before where the client/server are not able to complete the three way handshake? 

Thanks!


----------

