SOPHOS clients not registering with Console - TIME_WAIT against :8192

Hello Sean,

TIME_WAIT is the status of a socket after a TCP connection has been closed, it's normal and not unusual.

What's supposed to happen is that an endpoint contacts the server on 8192 to obtain the IOR. As the log says supplied address and port there should be the parent's IOR in the log (after the line Received parent router's IOR:) and you can parse this IOR for example here. You'll get one or more lines saying reachable with IIOP 1.2 at host address (that it gives port 8193 is correct), where the address is either an IP or an FQDN. Apparently these servers aren't able to open a connection to port 8194 using the address(es) given. You can check with telnet address 8194. The normal behaviour is that the connection succeeds, no data is returned but also no error.

Christian

Hello Sean,

TIME_WAIT is the status of a socket after a TCP connection has been closed, it's normal and not unusual.

What's supposed to happen is that an endpoint contacts the server on 8192 to obtain the IOR. As the log says supplied address and port there should be the parent's IOR in the log (after the line Received parent router's IOR:) and you can parse this IOR for example here. You'll get one or more lines saying reachable with IIOP 1.2 at host address (that it gives port 8193 is correct), where the address is either an IP or an FQDN. Apparently these servers aren't able to open a connection to port 8194 using the address(es) given. You can check with telnet address 8194. The normal behaviour is that the connection succeeds, no data is returned but also no error.

Christian

Thanks Christian,

Well I have another problem then.  Can't use the parse program for security reasons.  I can telnet RMS: 8194 (putty) and just get Connection closed by remote host.

Get this in log:

25.02.2018 23:30:11 0848 W MSClient::Connect: failed to get router's IOR from supplied address and port.

25.02.2018 23:30:11 0848 W NoRouterIORException: Caught MSClient::Connect: failed to get router's IOR from supplied address and port.

ClientConnection::Reconnect()

The Computer name/Domain/Parent address are correct in the attached.

Any further suggestions greatfully recieved.  200 VM's fine, the last 10+ all dont get logged in the Console and are sitting on 8192 TIME_WAIT

Cheers again,

Sean

Hello Sean,

telnet RMS: 8194
can't say if this is to expected from putty, Windows telnet just linger for a while and then closes.
As said, the TIME_WAIT and the logs indicate that these servers have obtained the IOR. Apparently they are unsuccessful to connect to the address returned in the IOR - without the IOR it's hard to say what they are. Your Parent address is rather short - just one IP or an FQDN? Did you configure RMS on the server to return a specific addres (IP or FQDN)?

Christian

Only 1 IP as I have been testing with 1 IP, 2 IP's and DNS names one by one.  I'll check routing back.

Thanks for your help

Hello Sean,

indeed putty to 8194 returns Session closed when using telnet, for raw it lingers a few seconds then closes.
As said, you have to test the address(es) returned in the IOR. If you can't use PARC's parser you could use this iordump.exe.

Christian