Connection reset errors

Ben Swenson · May 22, 2006, 11:06 AM

I've been getting connection reset errors from TFL on a fairly regular basis (maybe 5% of page loads).

Anyone else getting these?

FWIW, refreshing usually brings up the page.

**tyme** · May 22, 2006, 12:05 PM

After a significant delay or within 20 seconds or so?

I haven't noticed anything, but it would explain some other things...

Ben Swenson · May 22, 2006, 12:31 PM

Quote:

After a significant delay or within 20 seconds or so?

Oddly enough, no.

On Firefox, if I'm paying attention I can see the page start to load and then immediately flash to the Connection Reset error page.

Total time from click to error is less than five seconds.

I am not getting this error with other sites. It may well just be my machine or connection, but I thought I'd see if others were noticing a problem. I've seen a bunch of multiple posts that might be caused by a similar error (post is submitted, connection is reset, poster doesn't think post was submitted, page refreshed, post is resubmitted).

**tyme** · May 22, 2006, 12:59 PM

I have a sneaking suspicion the firewall isn't natting connections reliably. Will look into it.

Ben Swenson · May 22, 2006, 01:38 PM

Thanks Tyme.

And thanks for all the work you've put into geting TFL back online.

**tyme** · May 23, 2006, 01:23 AM

The new colo has some agressive network filters. It's possible you're inadvertently tripping one. When it happens again, get an accurate timestamp (plus timezone), and pm me that and your ip (if different from the one you used to post these last few messages) and I'll ask the colo people to check.

Ben Swenson · May 23, 2006, 11:29 AM

Will do.

Ben Swenson · May 23, 2006, 02:16 PM

Just had a handful of these errors. Sent you a PM or two. Hopefully two.

Got another one when trying to load the Reply screen here.

**tyme** · May 23, 2006, 11:26 PM

Has anyone else noticed occasional connection resets?

I sent the info to the colo for them to check. There's nothing relevant in the apache error log.

Assuming they claim it's not a firewall issue, can you run a packet sniffer and log traffic to/from tfl until it happens again?

I'm running tcpdump on the server for your ip. If you can get a packet log from your side and a rough timestamp (just note the url and rough time and I can get an accurate timestamp), comparing the two logs should conclusively resolve whether the firewall's at fault.

Even without the log, given another timestamp we can at least find out if the tfl server is the culprit. There just won't be any evidence that the colo's firewall is sabotaging the connection.

There are other strange network lags/disconnects with the server, but I haven't noticed anything of that sort on the website.

Ben Swenson · May 24, 2006, 09:37 AM

Quote:

Assuming they claim it's not a firewall issue, can you run a packet sniffer and log traffic to/from tfl until it happens again?

Sure thing. Running EtherDetect filtered for TFL's IP right now.

Quote:

I'm running tcpdump on the server for your ip.

Argh! Big brother! Big brother!

Quote:

If you can get a packet log from your side and a rough timestamp (just note the url and rough time and I can get an accurate timestamp), comparing the two logs should conclusively resolve whether the firewall's at fault.

You got it. I'll PM you if I get another one of those disconnects.

Ben Swenson · May 24, 2006, 09:55 AM

Got one when going to http://www.thefiringline.com/forums/...d.php?t=211533 at about 0951 eastern.

Packet log forthcoming.

**tyme** · May 24, 2006, 08:01 PM

Your firewall seems to be broken.

You got two TCP resets 6 seconds after the http request, and they weren't sent by the TFL server. 15 seconds after the http request, the TFL server got a RST out of the blue, with reset cause given as "ehnc", documented here:
http://72.14.209.104/search?q=cache:...s&ct=clnk&cd=2

The response to any given page request has a half dozen or more tcp fragments. In this case, one of them got lost (seq num 5841 is missing, the next one you got was seq 7301 in packet 1968 in your log).

SonicWall must have decided, inappropriately, that a missing tcp fragment constituted a Breach of the Peace, and proceeded to wreck the connection by sending a RST to your machine. After it closed its connection, the firewall dropped the connection from its connection table, and when TFL retransmitted the lost fragments, it got a RST with the "ehnc" message.

If there's a newer sonicwall firmware than you're using, try upgrading.

**Rich Lucibella** · May 24, 2006, 08:36 PM

I coulda figured that out....
.
.
-
.
.
.
.
.
.
.
.
.
.
.
.
.
NOT!

**Capt Charlie** · May 24, 2006, 10:12 PM

Heck Rich, at least you understood what he said! I'm still trying to figure out what language he's speaking!

**Rich Lucibella** · May 24, 2006, 10:28 PM

He's speaking a decipherable language?
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Yeah, I knew that.
Rich

**Al Norris** · May 24, 2006, 11:34 PM

LOL!!

Ben, ya just gotta thank your lucky stars that tyme is a good guy!

Charlie? Ya really don't want to know!

**Capt Charlie** · May 24, 2006, 11:52 PM

Quote:

Charlie? Ya really don't want to know!

Know what? That's he's got transistors instead of neurons and thinks in binary?

Just kidding Tyme! You're one sharp cookie and I'm envious

.

Back when DOS was Boss, and Veronica and Archie were more than comic book characters, I was halfways sharp at this stuff (I still use DOS for a lot of things), but I just couldn't keep up with it. Today, I'm so far behind I could never catch up. Besides, the mind just ain't as sharp when you're pushing 60

.

**Al Norris** · May 25, 2006, 08:18 AM

Quote:

Originally Posted by Capt Charlie

That's he's got transistors instead of neurons and thinks in binary?

Reminds me of the old sigline: There's 10 kinds of people. Those who know binary and those who don't.

Ben Swenson · May 25, 2006, 11:13 AM

Thanks, Tyme! Sorry to burn so much of your ... er ... time.

We're moving offices in a few weeks and after we get settled in I'll rebuild the firmware on our firewall.

Edward429451 · May 30, 2006, 07:59 PM

It cleared up for a few days but I'm getting garbled E-Mail notifications again. Not all of them but maybe 1/2 or so.

**tyme** · May 31, 2006, 09:30 AM

Are you sure they're not old notifications? I got a few notifications yesterday from posts on May 23rd-ish. They may or may not have been "garbled" (the garbling only happens on old/utf8-incompatible email clients, and I didn't check for that in the email before deleting it)

If you're getting notifications dated this week that are garbled, please repost.

Edward429451 · May 31, 2006, 09:43 AM

I got 4 garbled ones total. The last good one was at 139 pm on 05-30 followed by three garbled ones at 2:09 and one more garbled one at 2:10 pm and havent got any more garbled ones since.

**tyme** · May 31, 2006, 12:00 PM

I think the colo people didn't notice that I ditched qmail for postfix and were messing around with stuff they didn't understand.

May 22, 2006, 11:06 AM	#1
Ben Swenson Senior Member Join Date: May 17, 2000 Location: Indiana Posts: 1,213	Connection reset errors I've been getting connection reset errors from TFL on a fairly regular basis (maybe 5% of page loads). Anyone else getting these? FWIW, refreshing usually brings up the page. __________________ News, opinion, pictures and more. (formerly known as Cordex)

May 22, 2006, 12:05 PM	#2
tyme Staff Join Date: October 13, 2001 Location: Novalis 978-0553586251 Posts: 2,996	After a significant delay or within 20 seconds or so? I haven't noticed anything, but it would explain some other things... __________________ Proud reseller of little geisha dolls with big heads that wobble.

May 22, 2006, 12:59 PM	#4
tyme Staff Join Date: October 13, 2001 Location: Novalis 978-0553586251 Posts: 2,996	I have a sneaking suspicion the firewall isn't natting connections reliably. Will look into it. __________________ Proud reseller of little geisha dolls with big heads that wobble.

May 22, 2006, 01:38 PM	#5
Ben Swenson Senior Member Join Date: May 17, 2000 Location: Indiana Posts: 1,213	Thanks Tyme. And thanks for all the work you've put into geting TFL back online. __________________ News, opinion, pictures and more. (formerly known as Cordex)

May 23, 2006, 01:23 AM	#6
tyme Staff Join Date: October 13, 2001 Location: Novalis 978-0553586251 Posts: 2,996	The new colo has some agressive network filters. It's possible you're inadvertently tripping one. When it happens again, get an accurate timestamp (plus timezone), and pm me that and your ip (if different from the one you used to post these last few messages) and I'll ask the colo people to check. __________________ Proud reseller of little geisha dolls with big heads that wobble.

May 23, 2006, 11:29 AM	#7
Ben Swenson Senior Member Join Date: May 17, 2000 Location: Indiana Posts: 1,213	Will do. __________________ News, opinion, pictures and more. (formerly known as Cordex)

May 23, 2006, 02:16 PM	#8
Ben Swenson Senior Member Join Date: May 17, 2000 Location: Indiana Posts: 1,213	Just had a handful of these errors. Sent you a PM or two. Hopefully two. Got another one when trying to load the Reply screen here. __________________ News, opinion, pictures and more. (formerly known as Cordex)

May 23, 2006, 11:26 PM	#9
tyme Staff Join Date: October 13, 2001 Location: Novalis 978-0553586251 Posts: 2,996	Has anyone else noticed occasional connection resets? I sent the info to the colo for them to check. There's nothing relevant in the apache error log. Assuming they claim it's not a firewall issue, can you run a packet sniffer and log traffic to/from tfl until it happens again? I'm running tcpdump on the server for your ip. If you can get a packet log from your side and a rough timestamp (just note the url and rough time and I can get an accurate timestamp), comparing the two logs should conclusively resolve whether the firewall's at fault. Even without the log, given another timestamp we can at least find out if the tfl server is the culprit. There just won't be any evidence that the colo's firewall is sabotaging the connection. There are other strange network lags/disconnects with the server, but I haven't noticed anything of that sort on the website. __________________ Proud reseller of little geisha dolls with big heads that wobble.

May 24, 2006, 09:55 AM	#11
Ben Swenson Senior Member Join Date: May 17, 2000 Location: Indiana Posts: 1,213	Got one when going to http://www.thefiringline.com/forums/...d.php?t=211533 at about 0951 eastern. Packet log forthcoming. __________________ News, opinion, pictures and more. (formerly known as Cordex)

May 24, 2006, 08:01 PM	#12
tyme Staff Join Date: October 13, 2001 Location: Novalis 978-0553586251 Posts: 2,996	Your firewall seems to be broken. You got two TCP resets 6 seconds after the http request, and they weren't sent by the TFL server. 15 seconds after the http request, the TFL server got a RST out of the blue, with reset cause given as "ehnc", documented here: http://72.14.209.104/search?q=cache:...s&ct=clnk&cd=2 The response to any given page request has a half dozen or more tcp fragments. In this case, one of them got lost (seq num 5841 is missing, the next one you got was seq 7301 in packet 1968 in your log). SonicWall must have decided, inappropriately, that a missing tcp fragment constituted a Breach of the Peace, and proceeded to wreck the connection by sending a RST to your machine. After it closed its connection, the firewall dropped the connection from its connection table, and when TFL retransmitted the lost fragments, it got a RST with the "ehnc" message. If there's a newer sonicwall firmware than you're using, try upgrading. __________________ Proud reseller of little geisha dolls with big heads that wobble.

May 24, 2006, 08:36 PM	#13
Rich Lucibella Staff Join Date: October 6, 1998 Location: South Florida Posts: 10,130	I coulda figured that out.... . . - . . . . . . . . . . . . . NOT! __________________ S.W.A.T. Magazine Weapons, Training and Tactics for the Real World Join us at TFL or at AR15.com or on Facebook

May 24, 2006, 10:12 PM	#14
Capt Charlie Staff Join Date: March 24, 2005 Location: Steubenville, OH Posts: 4,302	Heck Rich, at least you understood what he said! I'm still trying to figure out what language he's speaking! __________________ TFL Members are ambassadors to the world for firearm owners. What kind of ambassador does *your* post make *you?* I train in earnest, to do the things that I pray in earnest, I'll never have to do. --Capt. Charlie

May 24, 2006, 10:28 PM	#15
Rich Lucibella Staff Join Date: October 6, 1998 Location: South Florida Posts: 10,130	He's speaking a decipherable language? . . . . . . . . . . . . . . Yeah, I knew that. Rich __________________ S.W.A.T. Magazine Weapons, Training and Tactics for the Real World Join us at TFL or at AR15.com or on Facebook

May 24, 2006, 11:34 PM	#16
Al Norris Staff Join Date: June 29, 2000 Location: Rupert, Idaho Posts: 8,742	LOL!! Ben, ya just gotta thank your lucky stars that tyme is a good guy! Charlie? Ya really don't want to know! __________________ Listings of the Current 2A Cases: http://thefiringline.com/forums/showthread.php?t=416973

May 25, 2006, 11:13 AM	#19
Ben Swenson Senior Member Join Date: May 17, 2000 Location: Indiana Posts: 1,213	Thanks, Tyme! Sorry to burn so much of your ... er ... time. We're moving offices in a few weeks and after we get settled in I'll rebuild the firmware on our firewall. __________________ News, opinion, pictures and more. (formerly known as Cordex)

May 30, 2006, 07:59 PM	#20
Edward429451 Senior Member Join Date: November 12, 2000 Location: Colorado Springs, Colorado Posts: 9,457	It cleared up for a few days but I'm getting garbled E-Mail notifications again. Not all of them but maybe 1/2 or so. __________________ "Always place your clothes and weapons where you can find them in the dark" Lazarus Long "Understand that the enemy is not the enemy in his own eyes ;this may offer you an opportunity to make him your friend. If not, you can kill him without hate, and quickly." Lazarus Long

May 31, 2006, 09:30 AM	#21
tyme Staff Join Date: October 13, 2001 Location: Novalis 978-0553586251 Posts: 2,996	Are you sure they're not old notifications? I got a few notifications yesterday from posts on May 23rd-ish. They may or may not have been "garbled" (the garbling only happens on old/utf8-incompatible email clients, and I didn't check for that in the email before deleting it) If you're getting notifications dated this week that are garbled, please repost. __________________ Proud reseller of little geisha dolls with big heads that wobble.

May 31, 2006, 09:43 AM	#22
Edward429451 Senior Member Join Date: November 12, 2000 Location: Colorado Springs, Colorado Posts: 9,457	I got 4 garbled ones total. The last good one was at 139 pm on 05-30 followed by three garbled ones at 2:09 and one more garbled one at 2:10 pm and havent got any more garbled ones since. __________________ "Always place your clothes and weapons where you can find them in the dark" Lazarus Long "Understand that the enemy is not the enemy in his own eyes ;this may offer you an opportunity to make him your friend. If not, you can kill him without hate, and quickly." Lazarus Long

May 31, 2006, 12:00 PM	#23
tyme Staff Join Date: October 13, 2001 Location: Novalis 978-0553586251 Posts: 2,996	I think the colo people didn't notice that I ditched qmail for postfix and were messing around with stuff they didn't understand. __________________ Proud reseller of little geisha dolls with big heads that wobble.