Solved

after tcp handshake done, no packets can be receieved on each other side,why??

Posted on 2013-01-17
10
626 Views
Last Modified: 2013-02-28
Dear Experts,
Now, i have experienced one issue of smtp sending mail via outlook express.
The email server is linux, and resides behind firewall, the outlook express client also lives behind a firewall.
I caught the packets both on client and server side.
It shows that after tcp handshaking, none of tcp packets can be received from each other any more. It is very strange. Client is sending tcp ack, server side is resending syn/ack again and again.
Can you give me an idea how to figure it out?
I paste the packet trace here for your information.
Please unzip it and change the .doc to .pcap and open it with wireshark.
Thanks!
smtp-doc2pcap.zip
0
Comment
Question by:matiascx
  • 4
  • 4
  • 2
10 Comments
 
LVL 34

Expert Comment

by:gr8gonzo
ID: 38787515
I'm going to guess that your email server has iptables running. Try disabling iptables temporarily and see if the packets make it through after that.

iptables is notorious for causing bizarre TCP behavior if it's not configured properly.
0
 

Author Comment

by:matiascx
ID: 38787553
Dear gr8gonzo,
Thanks for your quick response.
The iptables is off. I have double checked it.
What is more, the client and server can talk to each other in the packet i caught.
The strange thing is after tcp seems setup, no packets can be received on each side any more, that is the problem.
Thanks!
[root@ip-10-136-13-206 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
[root@ip-10-136-13-206 ~]# chkconfig  |grep iptables
iptables        0:off   1:off   2:off   3:off   4:off   5:off   6:off
[root@ip-10-136-13-206 ~]#
0
 
LVL 34

Expert Comment

by:gr8gonzo
ID: 38787642
Have you disabled the client-side firewall?

Any hardware firewalls/routers that have security features?
0
 
LVL 34

Expert Comment

by:gr8gonzo
ID: 38787646
Also, are you on a home internet connection, like Verizon FIOS or Cox Cable? Sometimes home internet providers will block SMTP sending unless it goes through their own SMTP server.
0
 

Author Comment

by:matiascx
ID: 38787704
Dear gr8gonzo,
The client side should work well. Becuase when i use another email account on another server. It works well.

Please know about that.
Thanks~!

What is more, when I change another networking environment , it is the same.
I think, the problem should be on the server side which i currently do not know.

Best Regards,
Robert
0
Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

 
LVL 34

Expert Comment

by:gr8gonzo
ID: 38787946
Changing the network environment won't always fix the problem, if the new environment also has the same problem. Unless you're in an environment that you know 100% for sure does not restrict outbound SMTP...

Also, some mail accounts on other servers can work fine - it depends on the server. For example, from my home PC, I cannot connect to my own server on port 25 (because of my ISP's restriction), but I can connect to GMail's SMTP server on port 465 (secure SMTP).

Don't assume things ARE working well just because they SHOULD be working well. When things SHOULD be working well, they usually are, but sometimes the most mysterious problems are in the unexpected exceptions.
0
 

Author Comment

by:matiascx
ID: 38788000
Yes. In fact, the server is an EC2 instance. When I change to other ec2 instance in the same subnet environment. The server also works well. So it should not be issues on client side, or ISP block the smtp issue. It should be server configuration issue.
The work server is centos, while the not work server is red hat enterprise linux.

Please know that.
Thanks!
Robert
0
 
LVL 57

Expert Comment

by:giltjr
ID: 38788026
Was the capture on the server side done directly on the server?

The server is acting as if it never received the final ACK in the 3-way handshake.

If you look the the server side capture the server:

received a SYN request
sent SYN, ACK reqeust
received ACK
resent SYN,ACK over and over.

So somehow it appears something may be blocking the final ACK in the handshake.
0
 

Author Comment

by:matiascx
ID: 38788052
Dear giltjr,
Thanks for your investigation.
Yes, that is what i am willing to figure out.
It seems server side does not receive the ack from server side packets.
From the client side, the client also does not receive the final handshake ack from server side.
It is very strange.
0
 
LVL 57

Accepted Solution

by:
giltjr earned 500 total points
ID: 38788317
The client did receive everything that the server sent.  There is no final ACK, the next packet that should flow from the server is the SMTP 220 welcome message.

There are only 3 packets that flow in a handshake.

SYN from client to server
SYN,ACK from server to client
ACK from client to server.


So if you did the capture on the server, then there is something higher up than the NIC that is dropping/blocking the incoming ACK from the client.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now