Hello all, this is regarding a problem I've been having and getting help
about on this list. Specificaly, a site we host that, when visited,
often returns a Netscape error: "Connection reset by peer". It's for this
domain and this domain only and its owner is getting understandably upset.
I did some packet logging to see what was going on and I thought I'd share
the results in case anyone here can interperet them better than I (very
likely). I'm assuming that the (DF) flags are signifigant, but I don't
know what they mean. One interesting thing is that although the browser
got that "connection reset" error, and I'd never clicked reload to load
the page, as soon as I click "ok", the tcpdump showed in one big "burp"
of data, a page of packets as thoguh I'd successfully pulled it up. Also,
the exact text of the error specifies "while Netscape was recieving data"
so apparently the connection is established, but then something being sent
confuses the browser (this works with IE, too. Not just Netscape) which
refuses to accept/translate any of the packets being sent. Possible?
Anyway. Here's excerpt:
22:58:06.292440 ppp-20.internet-frontier.net.62411 > www.unionjobs.com.80:
S 1944225:1944225(0) win 8192 <mss 1460> (DF)
22:58:06.292440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62411:
R 0:0(0) ack 1944226 win 0
22:58:06.872440 ppp-20.internet-frontier.net.62412 > www.unionjobs.com.80:
S 1944225:1944225(0) win 8192 <mss 1460> (DF)
22:58:06.872440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62412:
R 0:0(0) ack 1944226 win 0
22:58:07.472440 ppp-20.internet-frontier.net.62413 > www.unionjobs.com.80:
S 1944225:1944225(0) win 8192 <mss 1460> (DF)
22:58:07.472440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62413:
R 0:0(0) ack 1944226 win 0
22:58:08.072440 ppp-20.internet-frontier.net.62414 > www.unionjobs.com.80:
S 1944225:1944225(0) win 8192 <mss 1460> (DF)
22:58:08.072440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62414:
R 0:0(0) ack 1944226 win 0
22:58:08.232440 ppp-20.internet-frontier.net.62414 > www.unionjobs.com.80:
S 1946168:1946168(0) win 8192 <mss 1460> (DF)
22:58:08.232440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62414:
R 0:0(0) ack 1944 win 0
22:58:08.272440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62410:
S 2790906700:2790906700(0) ack 1937196 win 32736 <mss 1460>
22:58:08.422440 ppp-20.internet-frontier.net.62410 > www.unionjobs.com.80:
R 1937196:1937196(0) win 0
22:58:11.182440 ppp-20.internet-frontier.net.62415 > www.unionjobs.com.80:
S 1946168:1946168(0) win 8192 <mss 1460> (DF)
22:58:11.182440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62415:
R 0:0(0) ack 1946169 win 0
22:58:11.782440 ppp-20.internet-frontier.net.62416 > www.unionjobs.com.80:
S 1946168:1946168(0) win 8192 <mss 1460> (DF)
22:58:11.782440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62416:
R 0:0(0) ack 1946169 win 0
22:58:12.372440 ppp-20.internet-frontier.net.62417 > www.unionjobs.com.80:
S 1946168:1946168(0) win 8192 <mss 1460> (DF)
22:58:12.372440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62417:
R 0:0(0) ack 1946169 win 0
22:58:12.542440 ppp-20.internet-frontier.net.62417 > www.unionjobs.com.80:
S 1950484:1950484(0) win 8192 <mss 1460> (DF)
22:58:12.542440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62417:
R 0:0(0) ack 4317 win 0
22:58:15.482440 ppp-20.internet-frontier.net.62418 > www.unionjobs.com.80:
S 1950484:1950484(0) win 8192 <mss 1460> (DF)
22:58:15.482440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62418:
R 0:0(0) ack 1950485 win 0
22:58:15.482440 ppp-20.internet-frontier.net.62418 > www.unionjobs.com.80:
S 1950484:1950484(0) win 8192 <mss 1460> (DF)
22:58:15.482440 www.unionjobs.com.80 > ppp-20.internet-frontier.net.62418:
R 0:0(0) ack 1950485 win 0
22:58:16.082440 ppp-20.internet-frontier.net.62419 > www.unionjobs.com.80:
S 1950484:1950484(0) win 8192 <mss 1460> (DF)
As usual, I'm open to suggestions and growing more desperate by the hour.
Help! =:)
Brad Smith, Walnut Creek, Ca.
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
"Unix is life. The rest is (c) Microsoft, Inc."
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
-====---====---====---====---====---====---====---====---====---====---====-
to unsubscribe email "unsubscribe linux-admin" to [EMAIL PROTECTED]
See the linux-admin FAQ: http://www.kalug.lug.net/linux-admin-FAQ/
