Interesting Traces - Windows ignoring connection

This trace shows a connection request coming into a Windows 2000 server. The trace was done on the server with netmon then edited to reduce the number of lines and change the IP addresses. The Windows system ignores the connection requests at frames 6237, 6261, 6312, and 6404. Note however, the ARP requests that are going out after each connection request comes in. The connection requests are coming from another network, The ARP requests are going to one of the configured default routers. Windows needs to get the Ethernet MAC address to the router before it can respond to the connection attempt. The ARPs are for 1 of the 2 default routers that are configured. Unfortunately, this default router is not available so the ARPs go unanswered and hence the connections are ignored.

Note that if the server did not have an application listening on the target port (443) or the listen backlog on that port is reached then Windows would respond with a reset packet instead of just ignorning the request.

Frame    Time    Src MAC Addr    Dst MAC Addr    Protocol    Description    Src Other Addr    Dst Other Addr    Type Other Addr

6237    779.532704   10.1.1.1    172.16.16.172 TCP    ....S., len:    0, seq:1690883019-1690883019, ack 10.1.1.1   172.16.16.172    IP
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+ IP: ID = 0x5B92; Proto = TCP; Len: 48
+ TCP: ....S., len:    0, seq:1690883019-1690883019, ack:         0, win: 8192, src: 3531  dst:  443 
************************************************************************************************************

6240    780.032704   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6249    781.048329   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6259    782.063954   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6261    782.532704   10.1.1.1    172.16.16.172 TCP    ....S., len:    0, seq:1690883019-1690883019, ack 10.1.1.1   172.16.16.172    IP
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+ IP: ID = 0x5D92; Proto = TCP; Len: 48
+ TCP: ....S., len:    0, seq:1690883019-1690883019, ack:         0, win: 8192, src: 3531  dst:  443 
************************************************************************************************************

6266    783.126454   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6272    783.673329   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6278    784.235829   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6312    788.579579   10.1.1.1    172.16.16.172 TCP    ....S., len:    0, seq:1690883019-1690883019, ack 10.1.1.1   172.16.16.172    IP
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+ IP: ID = 0x5F92; Proto = TCP; Len: 48
+ TCP: ....S., len:    0, seq:1690883019-1690883019, ack:         0, win: 8192, src: 3531  dst:  443 
************************************************************************************************************

6313    788.579579   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6322    789.313954   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6324    789.985829   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6335    791.017079   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6341    792.079579   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6350    793.251454   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6404    800.673329   10.1.1.1    172.16.16.172 TCP    ....S., len:    0, seq:1690883019-1690883019, ack 10.1.1.1   172.16.16.172    IP
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+ IP: ID = 0x6192; Proto = TCP; Len: 48
+ TCP: ....S., len:    0, seq:1690883019-1690883019, ack:         0, win: 8192, src: 3531  dst:  443 
************************************************************************************************************

6414    801.454579   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6422    802.626454   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

6427    803.751454   172.16.16.172 *BROADCAST    ARP_RARP    ARP: Request, Target IP: 172.16.16.1         + ETHERNET: ETYPE = 0x0806 : Protocol = ARP:  Address Resolution Protocol
+ ARP_RARP: ARP: Request, Target IP: 172.16.16.1
************************************************************************************************************

This page was last modified on 03-06-05

Send comments and suggestions
to ndav1@cox.net