We help IT Professionals succeed at work.

TCP connection dropped, causing problems with website browsing.

846 Views
Last Modified: 2008-04-24
I have an entire office of people who experience problems with one particular site, www.accountingresearchmanager.com. The symptoms range from slow page loads, inability to login, being logged off randomly. The only information I have been able to find on this issue is a notification in our firewall that the TCP connection was dropped.


1      06/06/2007 09:19:50.400      Notice      Network Access      TCP connection dropped      160.109.110.142, 80, WAN, accountingresearchmanager.com      192.168.167.230, 1170, LAN, DALADMIN      TCP Port: 1170      


This is the only website that this has been happening with in the logs. Does anyone have some suggestions one what to check for this problem?
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2007

Commented:
I would test using ping and traceroute.
It could be the ste itself has issues on their side, or ISP/ DNS issues.

Also check it on DNSSTuff.com

I hope this helps !

Author

Commented:
I cannot complete a ping or tracert to their server from inside our network or from a web based utility.

They fail the following tests on DNS reports

Open DNS servers
NS agreement on SOA Serial #
SOA MINIMUM TTL value


We do have another office that has no problem getting to the website.
The site comes up like lightning for me -- extremely fast.

You have some firewall issue where you are either blocking a port, or an IP address range that includes this website.  You will have to manually go over the firewall settings for your network's WAN access to see where the problem is.  There is NOTHING wrong with the site, your firewall or proxy is killing it.

Author

Commented:
I have setup a rule in the firewall to allow all traffic from this site and it did not resolve the issue. We have gone over all of the requirements for Java, IE settings, etc with support and nothing has changed. Oddly enough... taking the www off of address has been working to resolve the issue.
CERTIFIED EXPERT

Commented:
Port 1170 has been known to be used by back door trojans.
I'm wondering if your rule is allowing traffic to pass through that port unhindered or if you have a subscription ,it might not be the culprit.

Author

Commented:
Well we have two offices with the same configuration as far as firewall and IPS goes, but it works fine in the other office.
CERTIFIED EXPERT

Commented:
same isp?

Author

Commented:
Same ISP

Author

Commented:
We have found that our work around is thwarted by several links in the site that redirect with the www prefix. We have also found that we have the same problem with www.wellsfargoadvantagefunds.com. I am at a loss, we have been able to rule out our IPS by putting it in layer 2 fallback. We are going to take our network out of the equation and plug a laptop straight into the T1 and see what happens with the website as soon as we get a chance. Other than that the only devices left in the path is our switches, does anyone know of a switch setting that could cause something like this?

Author

Commented:
In the end, we unplugged the cable from the WAN port on the firewall to hookup a laptop directly to the T1 to test it. After we tested it, we plugged the cable back into the WAN port and it started working fine. We haven't had a complaint since.

Mod, please close question.
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.