Connection Dropped in one Direction - microsoft/CSS_SQL_Networking_Tools GitHub Wiki

Connection Dropped in one Direction

This topic shows an example of a network device that drops packets from the server to the client but not from the client to the server. It shows two different forms of the Keep-Alive exchange failing.

Client Trace Ending

Frame  Time Offset Source IP   Dest IP     Description
------ ----------- ----------- ----------- ---------------------------------------------------------------------------------------------------
--- Normal Keep-Alive exchange
 80879   6.9647240 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
 80880   6.9647370 10.10.10.80 10.10.10.22 TCP:[Keep alive ack]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=0, Seq=485443881, Ack=3
 86690   7.1995430 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
 86691   7.2012300 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-Alive exchange
562075  37.2233860 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
562176  38.2390200 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
562282  39.2546830 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
562360  40.2567490 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
562582  41.2638740 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
562836  42.2761660 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
563044  43.2773670 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
563132  44.2929670 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
563226  45.2998900 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
563309  46.3010500 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388

--- Reset the connection because we have determined it is bad
563371  47.3010520 10.10.10.80 10.10.10.22 TCP:[Keep alive ack]Flags=...A.R.., SrcPort=57644, DstPort=1433, PayloadLen=0, Seq=485443881, Ack=3

Explanation of the Client Ending

  1. In the beginning, we see a normal idle connection Keep-Alive exchange at time offset 6.9-7.2.
  2. Thirty seconds later, the client sends another Keep-Alive packet to the server at offset 37.2.
  3. This Keep-Alive packet is not responded to, so the client sends additional Keep-Alive packets at 1 second intervals.
  4. After sending 10 Keep-Alive packets, the client resets the connection after an additional 1 second.

Server Trace Ending

Frame  Time Offset  Source IP   Dest IP     Description
------- ----------- ----------- ----------- ---------------------------------------------------------------------------------------------------
--- Normal Keep-Alive exchange
3286013 846.6853620 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3286014 846.6854800 10.10.10.80 10.10.10.22 TCP:[Keep alive ack]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=0, Seq=485443881, Ack=3
3286103 846.9202750 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3286104 846.9202900 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-Alive exchange 1
3294074 876.7022380 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3294251 877.3623640 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3294252 877.3623820 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 2
3294302 877.7022670 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3294461 878.3779980 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3294462 878.3780140 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 3
3294504 878.7022960 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3294673 879.3936570 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3294674 879.3936720 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 4
3294707 879.7023290 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3294825 880.3957140 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3294826 880.3957290 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 5
3294854 880.7023520 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3295287 881.4028290 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3295288 881.4028450 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 6
3295330 881.7023900 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3295767 882.4151100 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3295768 882.4151490 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 7
3295805 882.7024020 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3296218 883.4163330 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3296219 883.4164070 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 8
3296235 883.7024780 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3296407 884.4319290 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3296408 884.4320000 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 9
3296421 884.7024990 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3296606 885.4388350 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3296607 885.4388990 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Abnormal Keep-alive exchange 10
3296623 885.7025340 10.10.10.22 10.10.10.80 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=1, Seq=3891874347 - 3891874
3296784 886.4399930 10.10.10.80 10.10.10.22 TCP:[Keep alive]Flags=...A...., SrcPort=57644, DstPort=1433, PayloadLen=1, Seq=485443880 - 48544388
3296785 886.4400520 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=

--- Server resets the connection and the client resets the connection
3296807 886.7025570 10.10.10.22 10.10.10.80 TCP:[Keep alive ack]Flags=...A.R.., SrcPort=1433, DstPort=57644, PayloadLen=0, Seq=3891874348, Ack=
3296921 887.4403310 10.10.10.80 10.10.10.22 TCP:Flags=...A.R.., SrcPort=57644, DstPort=1433, PayloadLen=0, Seq=485443881, Ack=3891874348, Win=0

Explanation of the Server Ending

  1. In the beginning, we see the same normal Keep-Alive exchange as in the client. In the server trace, this appears at offset 846.
  2. Thirty seconds later, at offset 876 and Frame 3294074, the server sends a Keep-alive packet. It does not reach the client as indicated in the client trace. Therefore the client cannot acknowledge it and the server does not receive a Keep-Alive ACK. The server will continue sending Keep-Alive packets every second before resetting the connection.
  3. We do see the client's Keep-Alive packet sent at time offset 877 and Frame 3294251. The SQL Server machine receives this and sends the Keep-Alive ACK packet in the next frame. The client does not receive this packet and continues its path toward determining that the connection is bad.
  4. This pattern repeats for a total of 10 times.
  5. The server sends a RESET packet to the client. The client does not receive this.
  6. The server does, however, receive the RESET packet from the client.

The server packets do not reach the client, so the ending is simpler and shorter, while the server ending is longer due to having visibility into the client side of the conversation and trying to respond to it.

This pattern can also happen in the opposite direction where the client sees the server packets but the server does not see the client packets.