Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 26 replies
  • Subscribers 5 subscribers
  • Views 10144 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Intermittent disconnected servers in Entreprise Console

Carlos Fernandez1

Hello All,

Our environment contains one SEC 5.5.1 with server 2016, and is mainly use to protect Windows Server (2008R2, 2012R2,2016)

We are facing issues to have all servers connected to our console, numbers will go up and suddenly drop, and start to go up again

We have about 900 endpoints, where at max i will say we can see 300 connected all the rest is disconneted

On the SEC router log file we have many entries with

error code: 336462231 - error:140E0197:SSL routines:SSL_shutdown:shutdown while in init

I am assuming that all those actions are bring down the router service and that is why numbers dont go up and stay stable.

On the client side i can find various errors

19.05.2020 10:15:54 166C E ACE_SSL (5664|5740) error code: 336027804 - error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

some with 

19.05.2020 15:41:38 AED8 E ParentLogon::RegisterParent: Caught CORBA system exception, ID 'IDL:omg.org/CORBA/TRANSIENT:1.0'
OMG minor code (2), described as '*unknown description*', completed = NO

Clients will get connected and the suddenly disconnected for some hours, and then comeback online.

Help and guidance, to where to start looking will be appreciated
I am not sure all servers are afected in the same way

Thanks in advance
Carlos



This thread was automatically locked due to age.
Parents
  • 0

    Hi  

    Wireshark would be more helpful here, please check this article and see if it helps you to give it a start. 

    Shweta

    Community Support Engineer | Sophos Technical Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
    The New Home of Sophos Support Videos! - Visit Sophos Techvids
  • 0 in reply to Shweta

    Hi thanks for your answer

    I checked already this part with wireshark, but unfortunately did not get any client with the filter set in this article

    Regards,

  • 0 in reply to Carlos Fernandez1

    Hello  

    Do the servers, by any chance, have Lightspeed Smart Agent installed?

  • 0 in reply to DianneY

    No Lightspeed agent installed

    It is basically a dedicated server for Sophos

    SQL and Sophos applications

    Regards,

    Carlos

  • 0 in reply to Carlos Fernandez1

    Hello Carlos,

    no surprise that the filter shows no endpoints as it looks for connection attempts using TLS v1.0. They'd have to run an outdated version of RMS (lower than 4.x, from mid-2017), or there's have to be some intermediary device that tries to downgrade the protocol, or RMS on the endpoints is configured (I think this is possible) to use TLS v1.0. All this is more than unlikely.

    From your initial post I see error 0x1407609C(336027804 decimal), the full message text is HTTP spoken on HTTPS port. If you can't detect a pattern (that could help to narrow down on the problem) I'd suggest you try to identify an endpoint that "reliably" fails to connect and trace the attempted handshake with Wireshark - both on server and endpoint (filtering on port 8194 and endpoint or server IP respectively. As the connection is taken down early and there is no other chatter on this port the trace comprises only a few packets.

    Christian 

  • 0 in reply to QC

    Hi Christian,

    Here is the trace from a client which is not showing as not managed

    I did as well a Test-connection on port 8194 and it fails, but somehow packets get to destination, so I am getting a bit lost
    I have checked on our firewalls and there is no deny for this client on 8194

     

    2643 16.536574 10.137.153.179 10.137.249.17 TCP 66 59393 → 8192 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    2644 16.536625 10.137.249.17 10.137.153.179 TCP 66 8192 → 59393 [SYN, ACK, ECN] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    2645 16.537182 10.137.153.179 10.137.249.17 TCP 60 59393 → 8192 [ACK] Seq=1 Ack=1 Win=2102272 Len=0
    2646 16.537357 10.137.249.17 10.137.153.179 TCP 506 8192 → 59393 [PSH, ACK] Seq=1 Ack=1 Win=2102272 Len=452
    2647 16.537381 10.137.249.17 10.137.153.179 TCP 54 8192 → 59393 [FIN, ACK] Seq=453 Ack=1 Win=2102272 Len=0
    2648 16.537879 10.137.153.179 10.137.249.17 TCP 60 59393 → 8192 [ACK] Seq=1 Ack=454 Win=2101760 Len=0
    2649 16.537928 10.137.153.179 10.137.249.17 TCP 60 59393 → 8192 [FIN, ACK] Seq=1 Ack=454 Win=2101760 Len=0
    2650 16.537947 10.137.249.17 10.137.153.179 TCP 54 8192 → 59393 [ACK] Seq=454 Ack=2 Win=2102272 Len=0
    2651 16.539514 10.137.153.179 10.137.249.17 TCP 66 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    2652 16.539525 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    2719 17.042503 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    2720 17.042520 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    2804 17.558558 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    2805 17.558575 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    3151 19.573850 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    3152 19.573861 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    3264 20.074268 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    3265 20.074285 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    3363 20.589868 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    3364 20.589883 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    3710 22.605699 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    3711 22.605714 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    3798 23.120726 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    3799 23.120743 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    3862 23.636860 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    3863 23.636879 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    4228 25.652559 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    4229 25.652577 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    4302 26.167659 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    4303 26.167675 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    4386 26.683665 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    4387 26.683684 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    4734 28.699650 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    4735 28.699661 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    4805 29.214618 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    4806 29.214634 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    4872 29.730252 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    4873 29.730273 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    5217 31.746510 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    5218 31.746527 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    5296 32.261717 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    5297 32.261735 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    5373 32.777185 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    5374 32.777203 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    5755 34.793541 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    5756 34.793553 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    5833 35.309012 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    5834 35.309025 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    5896 35.824161 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    5897 35.824179 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    6335 37.841091 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    6336 37.841105 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    6398 38.341343 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    6399 38.341359 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    6467 38.841285 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    6468 38.841310 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    6795 40.857545 10.137.153.179 10.137.249.17 TCP 66 [TCP Port numbers reused] 59394 → 8194 [SYN, ECN, CWR] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    6796 40.857560 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    6875 41.372544 10.137.153.179 10.137.249.17 TCP 66 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
    6876 41.372561 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    6941 41.888771 10.137.153.179 10.137.249.17 TCP 62 [TCP Retransmission] 59394 → 8194 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
    6942 41.888794 10.137.249.17 10.137.153.179 TCP 54 8194 → 59394 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

  • 0 in reply to QC

    client_hello.txt

    I have attached here the capture from a client which is showing as not connected in console

    There is an interesting line with the server hello, where it says Malformed packet:TLS

    Regards,

    Carlos

  • 0 in reply to Carlos Fernandez1

    Hello Carlos,

    obtaining the IOR from port 8192 succeeds. But this client doesn't get as far as establishing a TCP connection on 8194, let alone initiating the handshake. But on to your next post.

    Christian

Reply Children
No Data
Unfiltered HTML