Friday, October 15, 2021

TCP Closing session with wrong SEQ and ACK

Hi ,

While troubleshooting an issue with a connexion towards our LTM , I did a packet capture and I was intrigued by the way our LTM is closing it's TCP sessions.

The client sends a FIN,ACK , the LTM responds with a ACK then a FIN,ACK and finally the client sends a ACK and the session is closed and everyone is happy... except Wireshark !

The LTM seems not to be using the wrong SEQ and ACK numbers in its FIN,ACK and Wireshark flags both packets as TCP out of order ( since the numbers don't match up )

Here is an example :

[IMG on my F5-BigIP Post ]

https://devcentral.f5.com/s/question/0D51T00008w3avySAA/tcp-closing-session-with-wrong-seq-and-ack

We are running : BIG-IP 12.1.5.3 Build 0.16.5 Engineering Hotfix

Anyone have an Idea why are we seeing this odd behavior ?

Thanks ,



No comments:

Post a Comment