[7.390] Web browsing and "The connection has been reset" message.

Hi,

From version 7.390 when I browse Webs I have many times "The connection has been reset" message (FireFox). I use http proxy in transparent mode but after turn off issue still persist.

Regards,
WaMaR

Parents

0 BarryG over 15 years ago

Check the IPS and PacketFilter logs and see if you can match the logs against your surfing.

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 WaMaR over 15 years ago in reply to BarryG

IPS and PacketFilter logs looks OK. I can't match the logs against my surfing. Only when I turn on http proxy, I saw strange big time when statuscode is 304:

statuscode="304" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="0" time="29488 ms"

Maybe this is a tip.


2009:02:17-09:23:55 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="200" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="231" time="1476 ms" request="0x822e270" url="www.samsung.pl/.../html"
2009:02:17-09:24:25 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="304" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="0" time="29488 ms" request="0x822e270" url="www.samsung.pl/.../Hardware"
2009:02:17-09:24:26 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="404" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="207" time="1547 ms" request="0x822e270" url="www.samsung.pl/.../html"
2009:02:17-09:24:30 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="404" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="207" time="1094 ms" request="0xb091bf90" url="www.samsung.pl/.../html"

0 WaMaR over 15 years ago in reply to WaMaR

Hello,

Wireshark shows RST flags in TCP packets.

What going on?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 WaMaR over 15 years ago in reply to WaMaR

Hello,

Wireshark shows RST flags in TCP packets.

What going on?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 BrucekConvergent over 15 years ago in reply to WaMaR

I reported this happening with a particular website and 7.306 ... Astaro support told me that some web servers, for some reason, send a RST after the inital connection, which the proxy dutifully reports as "Connection has been Reset" ... the real problem (at least in my case) lies with the web server, and not the Astaro Proxy.

So... does this "Connection has been reset" error happen on all web sites, or just a select few?

Oh, and what is the URL that you are using for the site you are showing RST packets for above? It looks to be in something other than english when I go to it using the IP... but it does come up OK in 7.306. Perhaps I need to use the URL.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 WaMaR over 15 years ago in reply to BrucekConvergent

Strange things but probably issue is with all Web pages for all computers in the same time while few seconds. In this example was for URL Wirtualna Polska - www.wp.pl. When I turn off transparent proxy is better now. Tomorrow I will continue investigation with transparent proxy off.

Best Regards,
WaMaR
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to WaMaR

OK... I'm running Proxy in standard mode... it may be a transparent proxy issue of some sort...

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 WaMaR over 15 years ago in reply to BrucekConvergent

When all day transparent Proxy was turn off then issue is gone.
Problem is with transparent proxy in this case.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 WaMaR over 15 years ago in reply to WaMaR

After upgrade to 7.395 I can use http transparent proxy and my issue is gone. Update 7.395 fix it.

Regards,
WaMaR
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel