Troubleshooting Network Connectivity: A TCP Reset Case Study

Troubleshooting Network Connectivity: A TCP Reset Case Study

A case study that demonstrates the importance of network traffic analysis and how it can help us solve connectivity issues. Please note that this case study is based on a simulated cybersecurity incident conducted as part of a training exercise.

The Scenario

A few weeks ago, several customers reported that they were unable to access a client company's website, they kept encountering a "connection refused" error after waiting for the page to load.

The Investigation

I attempted to visit the website and received the "connection refused" error. To troubleshoot the issue, I loaded the network analyzer tool and tried to load the page again.

During this process, my browser sent a TCP SYN packet to the web server to request the establishment of a TCP connection. Wireshark showed that the web server was responding with TCP RST packets, telling me that the connection was reset, along with the error message: "tcp port 80 reset."

The Analysis

After reviewing the network traffic logs, I found out that the protocols used for the network traffic were HTTP and TCP. But, the TCP packets sent to the web server were being reset. That's probably why the webpage wasn't loading.

Here's a simplified version of what I saw in the network traffic logs

1   0.000000  192.168.1.2  93.184.216.34  TCP  74  49152 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=945617733 TSecr=0 WS=128
2   0.011431  93.184.216.34  192.168.1.2  TCP  60  80 → 49152 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
3   0.022862  192.168.1.2  93.184.216.34  TCP  74  49152 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=945617733 TSecr=0 WS=128
4   0.034293  93.184.216.34  192.168.1.2  TCP  60  80 → 49152 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

Network Traffic Log Review

Lines 1 and 3 are the initial outgoing requests from the user’s computer (192.168.1.2) to the web server (93.184.216.34) on port 80, which is the standard port for HTTP traffic. These requests are sent in TCP packets with the SYN flag set, indicating an attempt to establish a TCP connection.

Lines 2 and 4 are the responses from the web server. Instead of the expected SYN-ACK packets to acknowledge the connection requests, the web server sends TCP packets with the RST (Reset) flag set, showing that the connection attempts have been refused.

Solution

I believe that there was a configuration issue on the server that is causing it to reset the TCP packets. I suggest checking the servers config settings and pay close attention to the ones that are related to TCP connections and firewall rules and making any changes if needed, and testing again. If the issue is persisted, I would recommend escalating the issue to the server’s hosing provider.

Tools used:

WireShark- used to capture and analyze network traffic while I was attempting to load the webpage. It showed that TCP packets sent to the web server were being reset which might have been the problem and was preventing the webpage from loading.

Lessons Learned

Better understanding of how http and tcp protocols work.

I learned about the TCP three way handshake process which is used to establish a TCP connection.

I also learned about the TCP reset flag which is used to terminate a TCP connection.