Windows server closes TCP connection immediately after sending SYN+ACK

connectiontcp

After a proper SYN, SYN+ACK and ACK TCP-Handshake, the server immediately sends a FIN+ACK indicating a graceful connection closure. The client's HTTP requests results in RST packets from server. This happens once in a 100 concurrent calls.
I have already investigated into SynAttackProtect parameter and Backlog Queue and these were related to connection resets, so unrelated to my problem.
So in what cases will a Windows server suddenly issue a FIN, immediately after a successful TCP handshake?

Best Answer

Http.sys intermittently ends TCP/IP connections in Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2618425

Http.sys has been superseded since that hotfix was released. If you want a more current version:

http://support.microsoft.com/kb/2634328

Related Solutions

Linux – Why would a server not send a SYN/ACK packet in response to a SYN packet

We had this exact same problem. Just disabling TCP timestamps solved the problem.

sysctl -w net.ipv4.tcp_timestamps=0

To make this change permanent, make an entry in /etc/sysctl.conf.

Be very careful about disabling the TCP Window Scale option. This option is important for providing maximum performance over the internet. Someone with a 10 megabit/sec connection will have a suboptimal transfer if the round trip time (basically same as ping) is more than 55 ms.

We really noticed this problem when there were multiple devices behind the same NAT. I suspect that the server might have been confused seeing timestamps from Android devices and OSX machines at the same time since they put completely different values in the timestamp fields.

Iptables – tcp flags in iptables: What’s the difference between RST SYN and RST and SYN RST ? When to use ALL

This:

-p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP

means "look at the flags syn, ack, fin and rst and match the packets that have the flag SYN set, and all the other unset"

The first argument of tcp-flags is the flags your are considering, the second argument is the mask you want to match. if you were using

--tcp-flags SYN,ACK SYN

then it would match packets that have [SYN=1 ACK=0], but it would not match packets that have [SYN=1,ACK=1] or [SYN=0,ACK=1] or [SYN=0,ACK=0]

In your rule above, you are matching SYN packets only.

Best Answer

Related Solutions

Linux – Why would a server not send a SYN/ACK packet in response to a SYN packet

Iptables – tcp flags in iptables: What’s the difference between RST SYN and RST and SYN RST ? When to use ALL

Related Topic