Connection reset by client

1

Dear All,

Please find the attached pcap file captured on ACS server…
Observed that after every Periodic inform GenieACS send FIN+ACK and close the connection and the clients establish the connection again before senidng the INFORM.
But somehow after sometime client send SYN,ACS sends SYN+ACK and reset from client…and this behaviour continues…
Why ACS server closes the TCP connection everytime and force client to create a new connection ?
Please help…
Attached is the pcap file.

2

For me, based on the PCAP file, it is normal behavior.
I’ll try to answer your question in parts…

“Observed that after every Periodic inform GenieACS send FIN+ACK and close the connection…”

That’s right! It’s the behavior of CWMP. When there is no more action to be performed, the session is closed. The connection will only be maintained as long as there are things to be done.

“… the clients establish the connection again before senidng the INFORM”

Yes, it is CWMP behavior.

“But somehow after sometime client send SYN,ACS sends SYN+ACK and reset from client…and this behaviour continues”

It’s normal. This cyclic behavior is because the inform periodic is enabled. It sends an Inform message to the ACS every X seconds, with the event code “2 Periodic”. It starts with the 3-way-handshake. Then, the CPE sends an Inform. The ACS sends an InformResponse. When there is nothing more to send, the connection will be closed. According to the PCAP file, the PeriodicInform interval is around 480 seconds (8 minutes).

“Why ACS server closes the TCP connection everytime and force client to create a new connection?”

The connection does not stay open forever, only while the CPE or ACS has requests to send to both, after which the session and the connection must be closed.

So, yes, it is correct:

  • the CPE sends the SYN, the ACS responds SYN + ACK and the CPE responds with ACK, as it is the 3-way-handshake: it is opening a new connection with the ACS
  • after that, the CPE sends an Inform
  • the ACS responds with an InformResponse to the CPE
  • if the CPE has nothing more to say, then it sends a POST request with an empty body to the ACS
  • if the ACS also has nothing more to say, it responds to the POST with status code 204 to close that session

note: a new session will be started every time the CPE wants to talk to the ACS and the session will be valid until both have nothing more to request.

Analysis of a PCAP file session
CPE: 10.157.45.100
ACS: 10.25.165.10

I’ll take, as an example, packet 69 to packet 97.
Note, the beginning of the connection(3-way-handshake) - packets 69, 70 and 71 and the end of the connection - packets 94, 95, 96 and 97.

image
image1914×729 344 KB

Since the CPE’s InformPeriodic is probably enabled, approximately every 8 minutes the CPE initiates a connection with the ACS. And this pattern repeats itself. For example, from packet 69 to 97 is a connection. From packet 98 to 124 is another connection. And this is correct.

image
image1911×1080 495 KB

Read Chapter 3, Section 3.4.2 and Annex A of the documentation https://www.broadband-forum.org/pdfs/tr-069-1-6-0.pdf

3

Dear Ojpojao

Thanks for your response.
After packet no 696 , client is sending SYN,ACS is respoding with SYN + ACK and then RST from client.(697-699) and this pattern continues.
client side is using easycwmp . Is it a bug at client side?

SYN+SYNACK+RST
SYN+SYNACK+RST1920×1159 411 KB

4

The CWMP process may be experiencing problems and is unable to respond to the ACS.
Try sending a connection request to check if the CPE responds.