Wireshark-users: Re: [Wireshark-users] help with results

From: Sake Blok <sake@xxxxxxxxxx>
Date: Mon, 13 Nov 2006 20:56:28 +0100
On Mon, Nov 13, 2006 at 02:02:44PM -0000, Andrew Watson wrote:
> I am a new user to wireshark so know very little... the reason I was advised to try wireshark was due to intremittent problems with my webserver whereby (usually) the first page request fails with an error message (the connection was reset in firefox)... I have managed to capture this behaviour in wireshark when requesting the site and I it lookes like step numbers 5 & 6 below (also attached as pcap file) are the actual errors (   TCP      http > 2058 [RST] Seq=1 Len=0   ) 
> 

I tried the website myself and got the same error on the first try. After
the first request, I can't seem to get the error back.

> I am hoping that someone can confirm that this is the problem and perhaps suggest what I can do to track down the cause? The webserver is running Apache 2.0.52 on CentOS4... 
> 

Indeed the TCP-RST that you see in frame 5&6 are responsible for the
message in Firefox. It tells you that the server (or maybe a load-balancer
of firewall in front of the server) does not accept the http-request
you sent it and so it resets the connection. 

Is your server hosted at a provider of do you host it on your own server?

Cheers,


Sake