<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">I had an issue with they symptom of the
connection closing as the first message was sent. If eventually
came down to the packet framing. When using syslog protocol (RFC
5424/5425) you must use framing. Without it syslog-ng drops the
connection.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">As Steve says, look for errors from the
receiving syslog-ng process. There should be an error immediately
preceding the closed connection.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Evan.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 2023-02-23 05:33, Steve Bernacki
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:8f41cd62-8025-dff5-05b3-7fe45e9cbd79@copacetic.net">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<br>
<div>
<p>Dragan,</p>
<p><br>
</p>
<p>1) Are you seeing any error or diagnostic message immediately
before "Syslog connection closed"? If a log message
immediately precedes this message with the same timestamp,
it's usually related even though there's nothing in the two
entries to tie them together.</p>
<p><br>
</p>
<p>2) Are the clients running syslog-ng?</p>
<p><br>
</p>
<p>3) Any other similarities with the clients that are not
working, e.g. on the same network segment etc? Could there be
some type of network IDS device sniping these connections?</p>
<p><br>
</p>
<p>Steve<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 2/23/2023 3:40 AM, Dragan
Zecevic wrote:<br>
</div>
<blockquote type="cite"
cite="mid:PAXPR01MB10192B24370E824E5F9752279F7AB9@PAXPR01MB10192.eurprd01.prod.exchangelabs.com">
<style type="text/css" style="display:none;">P {margin-top:0;margin-bottom:0;}</style>
<div style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0); background-color:
rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div class="elementToProof">
<div style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);
background-color: rgb(255, 255, 255);">
Hi again,</div>
<div id="Signature" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);
background-color: rgb(255, 255, 255);">
Does somebody have an idea on this?</div>
<div id="Signature" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);
background-color: rgb(255, 255, 255);">
<br>
</div>
<div id="Signature" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);
background-color: rgb(255, 255, 255);">
Thank you.</div>
<div id="Signature" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);
background-color: rgb(255, 255, 255);">
<br>
</div>
<div id="Signature" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);
background-color: rgb(255, 255, 255);">
Br,</div>
<div id="Signature" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);
background-color: rgb(255, 255, 255);">
Dragan</div>
<div><br>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt"
face="Calibri, sans-serif" color="#000000"><b>From:</b>
syslog-ng
<a class="moz-txt-link-rfc2396E"
href="mailto:syslog-ng-bounces@lists.balabit.hu"
moz-do-not-send="true">
<syslog-ng-bounces@lists.balabit.hu></a> on behalf
of Dragan Zecevic <a class="moz-txt-link-rfc2396E"
href="mailto:dragan.zecevic@live.com"
moz-do-not-send="true">
<dragan.zecevic@live.com></a><br>
<b>Sent:</b> Tuesday, February 14, 2023 2:33 PM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated
moz-txt-link-freetext"
href="mailto:syslog-ng@lists.balabit.hu"
moz-do-not-send="true">
syslog-ng@lists.balabit.hu</a> <a
class="moz-txt-link-rfc2396E"
href="mailto:syslog-ng@lists.balabit.hu"
moz-do-not-send="true">
<syslog-ng@lists.balabit.hu></a><br>
<b>Subject:</b> [syslog-ng] syslog-ng reset connection
before data transfer</font>
<div> </div>
</div>
<style type="text/css" style="display:none">p
{margin-top:0;
margin-bottom:0}</style>
<div dir="ltr">
<div class="x_elementToProof x_ContentPasted0"
style="font-family:Calibri,Helvetica,sans-serif;
font-size:12pt; color:rgb(0,0,0);
background-color:rgb(255,255,255)">
<div class="x_ContentPasted0 x_elementToProof">Hi
everybody,</div>
<div class="x_ContentPasted0 x_elementToProof">I hope you
are well.</div>
<div class="x_ContentPasted0 x_elementToProof"><br>
</div>
<div class="x_ContentPasted0 x_elementToProof">I was
hoping if you can help me with some issue.</div>
<div class="x_ContentPasted0">I am trying to collect logs
from some servers via syslog.</div>
<div class="x_ContentPasted0">TLS session seems to be
established - handshake, certs, ciphers all looking ok.</div>
<div class="x_ContentPasted0">But when data need to be
send it seems syslog-ng server disconnects the session
from some reason.</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">In /var/log/messages I can
only see start/stop messages even after turning on
verbose logging:</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">Feb 10 16:11:48 xxx
syslog-ng[21262]: Syslog connection accepted; fd='175',
client='AF_INET(x.y.w.z:34986)',
local='AF_INET(0.0.0.0:xxx)'</div>
<div class="x_ContentPasted0">Feb 10 16:11:49 xxx
syslog-ng[21262]: Syslog connection closed; fd='175',
client='AF_INET(x.y.w.z:34986)',
local='AF_INET(0.0.0.0:xxx)'</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">This is the configuration I
am using:</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">source s_xxx {</div>
<div class="x_ContentPasted0"> syslog(</div>
<div class="x_ContentPasted0"> ip(0.0.0.0)</div>
<div class="x_ContentPasted0"> port(xxx)</div>
<div class="x_ContentPasted0"> transport("tls")</div>
<div class="x_ContentPasted0"> tls(</div>
<div class="x_ContentPasted0">
key-file("/etc/syslog-ng/key.d/xxx.key")</div>
<div class="x_ContentPasted0">
cert-file("/etc/syslog-ng/cert.d/xxx.cer")</div>
<div class="x_ContentPasted0">
ca-dir("/etc/syslog-ng/ca.d")</div>
<div class="x_ContentPasted0">
peer-verify(required-trusted)</div>
<div class="x_ContentPasted0">
cipher-suite("xxx...xxx")</div>
<div class="x_ContentPasted0"> )</div>
<div class="x_ContentPasted0">
flags(store-raw-message)</div>
<div class="x_ContentPasted0"> );</div>
<div class="x_ContentPasted0">};</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">filter filter_xxx {</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0"> host("xxx")
... or host("xxx");</div>
<div class="x_ContentPasted0">};</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">destination folder_xxx {</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0"> file(</div>
<div class="x_ContentPasted0">
"/var/log/xxx/${R_YEAR}${R_MONTH}${R_DAY}/${SOURCEIP}_${HOST}_${R_HOUR}.log"</div>
<div class="x_ContentPasted0">
template("${RAWMSG}\n")</div>
<div class="x_ContentPasted0">
dir-group(xxx)</div>
<div class="x_ContentPasted0">
dir-perm(0650)</div>
<div class="x_ContentPasted0">
group(xxx)</div>
<div class="x_ContentPasted0"> );</div>
<div class="x_ContentPasted0">};</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">log {</div>
<div class="x_ContentPasted0">
source(s_xxx); filter(filter_xxx);
destination(folder_xxx); flags(flow-control);</div>
<div class="x_ContentPasted0">};</div>
<div><br class="x_ContentPasted0">
</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">And bellow is last part of
the session captured with tcpdump from source side.</div>
<div class="x_ContentPasted0 x_elementToProof">It is
interesting to me that there is 1h offset comparing to
/var/log/messages on syslog-ng. Src and dst server are
in same environment.</div>
<div><br class="x_ContentPasted0">
</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">24 2023-02-10
15:11:49,073335 x.y.w.z x.y.w.z TLSv1.2 445 Application
Data</div>
<div class="x_ContentPasted0">Frame 24: 445 bytes on wire
(3560 bits), 445 bytes captured (3560 bits)</div>
<div class="x_ContentPasted0"> Encapsulation type:
Ethernet (1)</div>
<div class="x_ContentPasted0"> Arrival Time: Feb 10,
2023 15:11:49.073335000 Central Europe Standard Time</div>
<div class="x_ContentPasted0"> [Time shift for this
packet: 0.000000000 seconds]</div>
<div class="x_ContentPasted0"> Epoch Time:
1676038309.073335000 seconds</div>
<div class="x_ContentPasted0"> [Time delta from
previous captured frame: 0.906559000 seconds]</div>
<div class="x_ContentPasted0"> [Time delta from
previous displayed frame: 0.906559000 seconds]</div>
<div class="x_ContentPasted0"> [Time since reference or
first frame: 6.775677000 seconds]</div>
<div class="x_ContentPasted0"> Frame Number: 24</div>
<div class="x_ContentPasted0"> Frame Length: 445 bytes
(3560 bits)</div>
<div class="x_ContentPasted0"> Capture Length: 445
bytes (3560 bits)</div>
<div class="x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_ContentPasted0"> [Frame is ignored:
False]</div>
<div class="x_ContentPasted0"> [Protocols in frame:
eth:ethertype:ip:tcp:tls]</div>
<div class="x_ContentPasted0"> [Coloring Rule Name:
TCP]</div>
<div class="x_ContentPasted0"> [Coloring Rule String:
tcp]</div>
<div class="x_ContentPasted0">Ethernet II, Src: xxx, Dst:
xxx</div>
<div class="x_ContentPasted0"> Destination: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Source: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_ContentPasted0">Internet Protocol Version 4,
Src: x.y.z.w, Dst: x.y.z.w</div>
<div class="x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_ContentPasted0"> .... 0101 = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Differentiated Services
Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_ContentPasted0"> 0000 00.. =
Differentiated Services Codepoint: Default (0)</div>
<div class="x_ContentPasted0"> .... ..00 = Explicit
Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_ContentPasted0"> Total Length: 431</div>
<div class="x_ContentPasted0"> Identification: 0xeebc
(61116)</div>
<div class="x_ContentPasted0"> 010. .... = Flags: 0x2,
Don't fragment</div>
<div class="x_ContentPasted0"> 0... .... = Reserved
bit: Not set</div>
<div class="x_ContentPasted0"> .1.. .... = Don't
fragment: Set</div>
<div class="x_ContentPasted0"> ..0. .... = More
fragments: Not set</div>
<div class="x_ContentPasted0"> ...0 0000 0000 0000 =
Fragment Offset: 0</div>
<div class="x_ContentPasted0"> Time to Live: 64</div>
<div class="x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_ContentPasted0"> Header Checksum: 0x0a89
[validation disabled]</div>
<div class="x_ContentPasted0"> [Header checksum status:
Unverified]</div>
<div class="x_ContentPasted0"> Source Address: x.y.z.w</div>
<div class="x_ContentPasted0"> Destination Address:
x.y.z.w</div>
<div class="x_ContentPasted0">Transmission Control
Protocol, Src Port: 34986, Dst Port: xxx, Seq: 2380,
Ack: 5750, Len: 391</div>
<div class="x_ContentPasted0"> Source Port: 34986</div>
<div class="x_ContentPasted0"> Destination Port: xxx</div>
<div class="x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_ContentPasted0"> [Conversation
completeness: Complete, WITH_DATA (63)]</div>
<div class="x_ContentPasted0"> [TCP Segment Len: 391]</div>
<div class="x_ContentPasted0"> Sequence Number: 2380
(relative sequence number)</div>
<div class="x_ContentPasted0"> Sequence Number (raw):
2630184540</div>
<div class="x_ContentPasted0"> [Next Sequence Number:
2771 (relative sequence number)]</div>
<div class="x_ContentPasted0"> Acknowledgment Number:
5750 (relative ack number)</div>
<div class="x_ContentPasted0"> Acknowledgment number
(raw): 2509794849</div>
<div class="x_ContentPasted0"> 0101 .... = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Flags: 0x018 (PSH, ACK)</div>
<div class="x_ContentPasted0"> 000. .... .... =
Reserved: Not set</div>
<div class="x_ContentPasted0"> ...0 .... .... =
Accurate ECN: Not set</div>
<div class="x_ContentPasted0"> .... 0... .... =
Congestion Window Reduced: Not set</div>
<div class="x_ContentPasted0"> .... .0.. .... =
ECN-Echo: Not set</div>
<div class="x_ContentPasted0"> .... ..0. .... =
Urgent: Not set</div>
<div class="x_ContentPasted0"> .... ...1 .... =
Acknowledgment: Set</div>
<div class="x_ContentPasted0"> .... .... 1... =
Push: Set</div>
<div class="x_ContentPasted0"> .... .... .0.. =
Reset: Not set</div>
<div class="x_ContentPasted0"> .... .... ..0. =
Syn: Not set</div>
<div class="x_ContentPasted0"> .... .... ...0 =
Fin: Not set</div>
<div class="x_ContentPasted0"> [TCP Flags:
·······AP···]</div>
<div class="x_ContentPasted0"> Window: 318</div>
<div class="x_ContentPasted0"> [Calculated window size:
40704]</div>
<div class="x_ContentPasted0"> [Window size scaling
factor: 128]</div>
<div class="x_ContentPasted0"> Checksum: 0x41a5
[unverified]</div>
<div class="x_ContentPasted0"> [Checksum Status:
Unverified]</div>
<div class="x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_ContentPasted0"> [Timestamps]</div>
<div class="x_ContentPasted0"> [Time since first
frame in this TCP stream: 1.007330000 seconds]</div>
<div class="x_ContentPasted0"> [Time since previous
frame in this TCP stream: 0.906559000 seconds]</div>
<div class="x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_ContentPasted0"> [iRTT: 0.003010000
seconds]</div>
<div class="x_ContentPasted0"> [Bytes in flight:
391]</div>
<div class="x_ContentPasted0"> [Bytes sent since
last PSH flag: 391]</div>
<div class="x_ContentPasted0"> TCP payload (391 bytes)</div>
<div class="x_ContentPasted0">Transport Layer Security</div>
<div class="x_ContentPasted0"> TLSv1.2 Record Layer:
Application Data Protocol: Application Data</div>
<div class="x_ContentPasted0"> Content Type:
Application Data (23)</div>
<div class="x_ContentPasted0"> Version: TLS 1.2
(0x0303)</div>
<div class="x_ContentPasted0"> Length: 386</div>
<div class="x_ContentPasted0"> Encrypted
Application Data:
000000000000000146f17ff0e884c81f9317ba9e01c3b48763944e3905fb27fc96ce76fc…</div>
<div><br class="x_ContentPasted0">
</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">25 2023-02-10
15:11:49,076214 x.y.z.w x.y.z.w TCP 60 xxx
→ 34986 [FIN, ACK] Seq=5750 Ack=2771 Win=65536 Len=0</div>
<div class="x_ContentPasted0">Frame 25: 60 bytes on wire
(480 bits), 60 bytes captured (480 bits)</div>
<div class="x_ContentPasted0"> Encapsulation type:
Ethernet (1)</div>
<div class="x_ContentPasted0"> Arrival Time: Feb 10,
2023 15:11:49.076214000 Central Europe Standard Time</div>
<div class="x_ContentPasted0"> [Time shift for this
packet: 0.000000000 seconds]</div>
<div class="x_ContentPasted0"> Epoch Time:
1676038309.076214000 seconds</div>
<div class="x_ContentPasted0"> [Time delta from
previous captured frame: 0.002879000 seconds]</div>
<div class="x_ContentPasted0"> [Time delta from
previous displayed frame: 0.002879000 seconds]</div>
<div class="x_ContentPasted0"> [Time since reference or
first frame: 6.778556000 seconds]</div>
<div class="x_ContentPasted0"> Frame Number: 25</div>
<div class="x_ContentPasted0"> Frame Length: 60 bytes
(480 bits)</div>
<div class="x_ContentPasted0"> Capture Length: 60 bytes
(480 bits)</div>
<div class="x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_ContentPasted0"> [Frame is ignored:
False]</div>
<div class="x_ContentPasted0"> [Protocols in frame:
eth:ethertype:ip:tcp]</div>
<div class="x_ContentPasted0"> [Coloring Rule Name: TCP
SYN/FIN]</div>
<div class="x_ContentPasted0"> [Coloring Rule String:
tcp.flags & 0x02 || tcp.flags.fin == 1]</div>
<div class="x_ContentPasted0">Ethernet II, Src: xxx, Dst:
xxx</div>
<div class="x_ContentPasted0"> Destination: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Source: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_ContentPasted0"> Trailer: 000085725dce</div>
<div class="x_ContentPasted0">Internet Protocol Version 4,
Src: x.y.z.w, Dst: x.y.z.w</div>
<div class="x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_ContentPasted0"> .... 0101 = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Differentiated Services
Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_ContentPasted0"> 0000 00.. =
Differentiated Services Codepoint: Default (0)</div>
<div class="x_ContentPasted0"> .... ..00 = Explicit
Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_ContentPasted0"> Total Length: 40</div>
<div class="x_ContentPasted0"> Identification: 0xea10
(59920)</div>
<div class="x_ContentPasted0"> 010. .... = Flags: 0x2,
Don't fragment</div>
<div class="x_ContentPasted0"> 0... .... = Reserved
bit: Not set</div>
<div class="x_ContentPasted0"> .1.. .... = Don't
fragment: Set</div>
<div class="x_ContentPasted0"> ..0. .... = More
fragments: Not set</div>
<div class="x_ContentPasted0"> ...0 0000 0000 0000 =
Fragment Offset: 0</div>
<div class="x_ContentPasted0"> Time to Live: 52</div>
<div class="x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_ContentPasted0"> Header Checksum: 0x1cbc
[validation disabled]</div>
<div class="x_ContentPasted0"> [Header checksum status:
Unverified]</div>
<div class="x_ContentPasted0"> Source Address: x.y.z.w</div>
<div class="x_ContentPasted0"> Destination Address:
x.y.z.w</div>
<div class="x_ContentPasted0">Transmission Control
Protocol, Src Port: xxx, Dst Port: 34986, Seq: 5750,
Ack: 2771, Len: 0</div>
<div class="x_ContentPasted0"> Source Port: xxx</div>
<div class="x_ContentPasted0"> Destination Port: 34986</div>
<div class="x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_ContentPasted0"> [Conversation
completeness: Complete, WITH_DATA (63)]</div>
<div class="x_ContentPasted0"> [TCP Segment Len: 0]</div>
<div class="x_ContentPasted0"> Sequence Number: 5750
(relative sequence number)</div>
<div class="x_ContentPasted0"> Sequence Number (raw):
2509794849</div>
<div class="x_ContentPasted0"> [Next Sequence Number:
5751 (relative sequence number)]</div>
<div class="x_ContentPasted0"> Acknowledgment Number:
2771 (relative ack number)</div>
<div class="x_ContentPasted0"> Acknowledgment number
(raw): 2630184931</div>
<div class="x_ContentPasted0"> 0101 .... = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Flags: 0x011 (FIN, ACK)</div>
<div class="x_ContentPasted0"> 000. .... .... =
Reserved: Not set</div>
<div class="x_ContentPasted0"> ...0 .... .... =
Accurate ECN: Not set</div>
<div class="x_ContentPasted0"> .... 0... .... =
Congestion Window Reduced: Not set</div>
<div class="x_ContentPasted0"> .... .0.. .... =
ECN-Echo: Not set</div>
<div class="x_ContentPasted0"> .... ..0. .... =
Urgent: Not set</div>
<div class="x_ContentPasted0"> .... ...1 .... =
Acknowledgment: Set</div>
<div class="x_ContentPasted0"> .... .... 0... =
Push: Not set</div>
<div class="x_ContentPasted0"> .... .... .0.. =
Reset: Not set</div>
<div class="x_ContentPasted0"> .... .... ..0. =
Syn: Not set</div>
<div class="x_ContentPasted0"> .... .... ...1 =
Fin: Set</div>
<div class="x_ContentPasted0"> [TCP Flags:
·······A···F]</div>
<div class="x_ContentPasted0"> Window: 4</div>
<div class="x_ContentPasted0"> [Calculated window size:
65536]</div>
<div class="x_ContentPasted0"> [Window size scaling
factor: 16384]</div>
<div class="x_ContentPasted0"> Checksum: 0xc512
[unverified]</div>
<div class="x_ContentPasted0"> [Checksum Status:
Unverified]</div>
<div class="x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_ContentPasted0"> [Timestamps]</div>
<div class="x_ContentPasted0"> [Time since first
frame in this TCP stream: 1.010209000 seconds]</div>
<div class="x_ContentPasted0"> [Time since previous
frame in this TCP stream: 0.002879000 seconds]</div>
<div class="x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_ContentPasted0"> [This is an ACK to
the segment in frame: 24]</div>
<div class="x_ContentPasted0"> [The RTT to ACK the
segment was: 0.002879000 seconds]</div>
<div class="x_ContentPasted0"> [iRTT: 0.003010000
seconds]</div>
<div><br class="x_ContentPasted0">
</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">26 2023-02-10
15:11:49,117776 x.y.z.w x.y.z.w TCP 54 34986
→ xxx [ACK] Seq=2771 Ack=5751 Win=40704 Len=0</div>
<div class="x_ContentPasted0">Frame 26: 54 bytes on wire
(432 bits), 54 bytes captured (432 bits)</div>
<div class="x_ContentPasted0"> Encapsulation type:
Ethernet (1)</div>
<div class="x_ContentPasted0"> Arrival Time: Feb 10,
2023 15:11:49.117776000 Central Europe Standard Time</div>
<div class="x_ContentPasted0"> [Time shift for this
packet: 0.000000000 seconds]</div>
<div class="x_ContentPasted0"> Epoch Time:
1676038309.117776000 seconds</div>
<div class="x_ContentPasted0"> [Time delta from
previous captured frame: 0.041562000 seconds]</div>
<div class="x_ContentPasted0"> [Time delta from
previous displayed frame: 0.041562000 seconds]</div>
<div class="x_ContentPasted0"> [Time since reference or
first frame: 6.820118000 seconds]</div>
<div class="x_ContentPasted0"> Frame Number: 26</div>
<div class="x_ContentPasted0"> Frame Length: 54 bytes
(432 bits)</div>
<div class="x_ContentPasted0"> Capture Length: 54 bytes
(432 bits)</div>
<div class="x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_ContentPasted0"> [Frame is ignored:
False]</div>
<div class="x_ContentPasted0"> [Protocols in frame:
eth:ethertype:ip:tcp]</div>
<div class="x_ContentPasted0"> [Coloring Rule Name:
TCP]</div>
<div class="x_ContentPasted0"> [Coloring Rule String:
tcp]</div>
<div class="x_ContentPasted0">Ethernet II, Src:
Mellanox_69:6f:47 (1c:34:da:69:6f:47), Dst:
ICANNIAN_00:40:20 (00:00:5e:00:40:20)</div>
<div class="x_ContentPasted0"> Destination:
ICANNIAN_00:40:20 (00:00:5e:00:40:20)</div>
<div class="x_ContentPasted0"> Address:
ICANNIAN_00:40:20 (00:00:5e:00:40:20)</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Source:
Mellanox_69:6f:47 (1c:34:da:69:6f:47)</div>
<div class="x_ContentPasted0"> Address:
Mellanox_69:6f:47 (1c:34:da:69:6f:47)</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_ContentPasted0">Internet Protocol Version 4,
Src: x.y.z.w, Dst: x.y.z.w</div>
<div class="x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_ContentPasted0"> .... 0101 = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Differentiated Services
Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_ContentPasted0"> 0000 00.. =
Differentiated Services Codepoint: Default (0)</div>
<div class="x_ContentPasted0"> .... ..00 = Explicit
Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_ContentPasted0"> Total Length: 40</div>
<div class="x_ContentPasted0"> Identification: 0xeebd
(61117)</div>
<div class="x_ContentPasted0"> 010. .... = Flags: 0x2,
Don't fragment</div>
<div class="x_ContentPasted0"> 0... .... = Reserved
bit: Not set</div>
<div class="x_ContentPasted0"> .1.. .... = Don't
fragment: Set</div>
<div class="x_ContentPasted0"> ..0. .... = More
fragments: Not set</div>
<div class="x_ContentPasted0"> ...0 0000 0000 0000 =
Fragment Offset: 0</div>
<div class="x_ContentPasted0"> Time to Live: 64</div>
<div class="x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_ContentPasted0"> Header Checksum: 0x0c0f
[validation disabled]</div>
<div class="x_ContentPasted0"> [Header checksum status:
Unverified]</div>
<div class="x_ContentPasted0"> Source Address: x.y.z.w</div>
<div class="x_ContentPasted0"> Destination Address:
x.y.z.w</div>
<div class="x_ContentPasted0">Transmission Control
Protocol, Src Port: 34986, Dst Port: xxx, Seq: 2771,
Ack: 5751, Len: 0</div>
<div class="x_ContentPasted0"> Source Port: 34986</div>
<div class="x_ContentPasted0"> Destination Port: xxx</div>
<div class="x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_ContentPasted0"> [Conversation
completeness: Complete, WITH_DATA (63)]</div>
<div class="x_ContentPasted0"> [TCP Segment Len: 0]</div>
<div class="x_ContentPasted0"> Sequence Number: 2771
(relative sequence number)</div>
<div class="x_ContentPasted0"> Sequence Number (raw):
2630184931</div>
<div class="x_ContentPasted0"> [Next Sequence Number:
2771 (relative sequence number)]</div>
<div class="x_ContentPasted0"> Acknowledgment Number:
5751 (relative ack number)</div>
<div class="x_ContentPasted0"> Acknowledgment number
(raw): 2509794850</div>
<div class="x_ContentPasted0"> 0101 .... = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Flags: 0x010 (ACK)</div>
<div class="x_ContentPasted0"> 000. .... .... =
Reserved: Not set</div>
<div class="x_ContentPasted0"> ...0 .... .... =
Accurate ECN: Not set</div>
<div class="x_ContentPasted0"> .... 0... .... =
Congestion Window Reduced: Not set</div>
<div class="x_ContentPasted0"> .... .0.. .... =
ECN-Echo: Not set</div>
<div class="x_ContentPasted0"> .... ..0. .... =
Urgent: Not set</div>
<div class="x_ContentPasted0"> .... ...1 .... =
Acknowledgment: Set</div>
<div class="x_ContentPasted0"> .... .... 0... =
Push: Not set</div>
<div class="x_ContentPasted0"> .... .... .0.. =
Reset: Not set</div>
<div class="x_ContentPasted0"> .... .... ..0. =
Syn: Not set</div>
<div class="x_ContentPasted0"> .... .... ...0 =
Fin: Not set</div>
<div class="x_ContentPasted0"> [TCP Flags:
·······A····]</div>
<div class="x_ContentPasted0"> Window: 318</div>
<div class="x_ContentPasted0"> [Calculated window size:
40704]</div>
<div class="x_ContentPasted0"> [Window size scaling
factor: 128]</div>
<div class="x_ContentPasted0"> Checksum: 0x401e
[unverified]</div>
<div class="x_ContentPasted0"> [Checksum Status:
Unverified]</div>
<div class="x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_ContentPasted0"> [Timestamps]</div>
<div class="x_ContentPasted0"> [Time since first
frame in this TCP stream: 1.051771000 seconds]</div>
<div class="x_ContentPasted0"> [Time since previous
frame in this TCP stream: 0.041562000 seconds]</div>
<div class="x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_ContentPasted0"> [This is an ACK to
the segment in frame: 25]</div>
<div class="x_ContentPasted0"> [The RTT to ACK the
segment was: 0.041562000 seconds]</div>
<div class="x_ContentPasted0"> [iRTT: 0.003010000
seconds]</div>
<div><br class="x_ContentPasted0">
</div>
<div><br class="x_ContentPasted0">
</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">27 2023-02-10
15:12:10,183395 x.y.w.z x.y.w.z TLSv1.2 457 Application
Data</div>
<div class="x_ContentPasted0">Frame 27: 457 bytes on wire
(3656 bits), 457 bytes captured (3656 bits)</div>
<div class="x_ContentPasted0"> Encapsulation type:
Ethernet (1)</div>
<div class="x_ContentPasted0"> Arrival Time: Feb 10,
2023 15:12:10.183395000 Central Europe Standard Time</div>
<div class="x_ContentPasted0"> [Time shift for this
packet: 0.000000000 seconds]</div>
<div class="x_ContentPasted0"> Epoch Time:
1676038330.183395000 seconds</div>
<div class="x_ContentPasted0"> [Time delta from
previous captured frame: 21.065619000 seconds]</div>
<div class="x_ContentPasted0"> [Time delta from
previous displayed frame: 21.065619000 seconds]</div>
<div class="x_ContentPasted0"> [Time since reference or
first frame: 27.885737000 seconds]</div>
<div class="x_ContentPasted0"> Frame Number: 27</div>
<div class="x_ContentPasted0"> Frame Length: 457 bytes
(3656 bits)</div>
<div class="x_ContentPasted0"> Capture Length: 457
bytes (3656 bits)</div>
<div class="x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_ContentPasted0"> [Frame is ignored:
False]</div>
<div class="x_ContentPasted0"> [Protocols in frame:
eth:ethertype:ip:tcp:tls]</div>
<div class="x_ContentPasted0"> [Coloring Rule Name:
TCP]</div>
<div class="x_ContentPasted0"> [Coloring Rule String:
tcp]</div>
<div class="x_ContentPasted0">Ethernet II, Src: xxx, Dst:
xxx</div>
<div class="x_ContentPasted0"> Destination: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Source: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_ContentPasted0">Internet Protocol Version 4,
Src: x.y.w.z, Dst: x.y.w.z</div>
<div class="x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_ContentPasted0"> .... 0101 = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Differentiated Services
Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_ContentPasted0"> 0000 00.. =
Differentiated Services Codepoint: Default (0)</div>
<div class="x_ContentPasted0"> .... ..00 = Explicit
Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_ContentPasted0"> Total Length: 443</div>
<div class="x_ContentPasted0"> Identification: 0xeebe
(61118)</div>
<div class="x_ContentPasted0"> 010. .... = Flags: 0x2,
Don't fragment</div>
<div class="x_ContentPasted0"> 0... .... = Reserved
bit: Not set</div>
<div class="x_ContentPasted0"> .1.. .... = Don't
fragment: Set</div>
<div class="x_ContentPasted0"> ..0. .... = More
fragments: Not set</div>
<div class="x_ContentPasted0"> ...0 0000 0000 0000 =
Fragment Offset: 0</div>
<div class="x_ContentPasted0"> Time to Live: 64</div>
<div class="x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_ContentPasted0"> Header Checksum: 0x0a7b
[validation disabled]</div>
<div class="x_ContentPasted0"> [Header checksum status:
Unverified]</div>
<div class="x_ContentPasted0"> Source Address: x.y.w.z</div>
<div class="x_ContentPasted0"> Destination Address:
x.y.w.z</div>
<div class="x_ContentPasted0">Transmission Control
Protocol, Src Port: 34986, Dst Port: xxx, Seq: 2771,
Ack: 5751, Len: 403</div>
<div class="x_ContentPasted0"> Source Port: 34986</div>
<div class="x_ContentPasted0"> Destination Port: xxx</div>
<div class="x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_ContentPasted0"> [Conversation
completeness: Complete, WITH_DATA (63)]</div>
<div class="x_ContentPasted0"> [TCP Segment Len: 403]</div>
<div class="x_ContentPasted0"> Sequence Number: 2771
(relative sequence number)</div>
<div class="x_ContentPasted0"> Sequence Number (raw):
2630184931</div>
<div class="x_ContentPasted0"> [Next Sequence Number:
3174 (relative sequence number)]</div>
<div class="x_ContentPasted0"> Acknowledgment Number:
5751 (relative ack number)</div>
<div class="x_ContentPasted0"> Acknowledgment number
(raw): 2509794850</div>
<div class="x_ContentPasted0"> 0101 .... = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Flags: 0x018 (PSH, ACK)</div>
<div class="x_ContentPasted0"> 000. .... .... =
Reserved: Not set</div>
<div class="x_ContentPasted0"> ...0 .... .... =
Accurate ECN: Not set</div>
<div class="x_ContentPasted0"> .... 0... .... =
Congestion Window Reduced: Not set</div>
<div class="x_ContentPasted0"> .... .0.. .... =
ECN-Echo: Not set</div>
<div class="x_ContentPasted0"> .... ..0. .... =
Urgent: Not set</div>
<div class="x_ContentPasted0"> .... ...1 .... =
Acknowledgment: Set</div>
<div class="x_ContentPasted0"> .... .... 1... =
Push: Set</div>
<div class="x_ContentPasted0"> .... .... .0.. =
Reset: Not set</div>
<div class="x_ContentPasted0"> .... .... ..0. =
Syn: Not set</div>
<div class="x_ContentPasted0"> .... .... ...0 =
Fin: Not set</div>
<div class="x_ContentPasted0"> [TCP Flags:
·······AP···]</div>
<div class="x_ContentPasted0"> Window: 318</div>
<div class="x_ContentPasted0"> [Calculated window size:
40704]</div>
<div class="x_ContentPasted0"> [Window size scaling
factor: 128]</div>
<div class="x_ContentPasted0"> Checksum: 0x41b1
[unverified]</div>
<div class="x_ContentPasted0"> [Checksum Status:
Unverified]</div>
<div class="x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_ContentPasted0"> [Timestamps]</div>
<div class="x_ContentPasted0"> [Time since first
frame in this TCP stream: 22.117390000 seconds]</div>
<div class="x_ContentPasted0"> [Time since previous
frame in this TCP stream: 21.065619000 seconds]</div>
<div class="x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_ContentPasted0"> [iRTT: 0.003010000
seconds]</div>
<div class="x_ContentPasted0"> [Bytes in flight:
403]</div>
<div class="x_ContentPasted0"> [Bytes sent since
last PSH flag: 403]</div>
<div class="x_ContentPasted0"> TCP payload (403 bytes)</div>
<div class="x_ContentPasted0">Transport Layer Security</div>
<div class="x_ContentPasted0"> TLSv1.2 Record Layer:
Application Data Protocol: Application Data</div>
<div class="x_ContentPasted0"> Content Type:
Application Data (23)</div>
<div class="x_ContentPasted0"> Version: TLS 1.2
(0x0303)</div>
<div class="x_ContentPasted0"> Length: 398</div>
<div class="x_ContentPasted0"> Encrypted
Application Data:
0000000000000002be4aae5822b205849734ad881717619991987bc9817d0b0417781265…</div>
<div><br class="x_ContentPasted0">
</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">28 2023-02-10
15:12:10,185930 x.y.w.z x.y.w.z TCP 60 xxx
→ 34986 [RST] Seq=5751 Win=0 Len=0</div>
<div class="x_ContentPasted0">Frame 28: 60 bytes on wire
(480 bits), 60 bytes captured (480 bits)</div>
<div class="x_ContentPasted0"> Encapsulation type:
Ethernet (1)</div>
<div class="x_ContentPasted0"> Arrival Time: Feb 10,
2023 15:12:10.185930000 Central Europe Standard Time</div>
<div class="x_ContentPasted0"> [Time shift for this
packet: 0.000000000 seconds]</div>
<div class="x_ContentPasted0"> Epoch Time:
1676038330.185930000 seconds</div>
<div class="x_ContentPasted0"> [Time delta from
previous captured frame: 0.002535000 seconds]</div>
<div class="x_ContentPasted0"> [Time delta from
previous displayed frame: 0.002535000 seconds]</div>
<div class="x_ContentPasted0"> [Time since reference or
first frame: 27.888272000 seconds]</div>
<div class="x_ContentPasted0"> Frame Number: 28</div>
<div class="x_ContentPasted0"> Frame Length: 60 bytes
(480 bits)</div>
<div class="x_ContentPasted0"> Capture Length: 60 bytes
(480 bits)</div>
<div class="x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_ContentPasted0"> [Frame is ignored:
False]</div>
<div class="x_ContentPasted0"> [Protocols in frame:
eth:ethertype:ip:tcp]</div>
<div class="x_ContentPasted0"> [Coloring Rule Name: TCP
RST]</div>
<div class="x_ContentPasted0"> [Coloring Rule String:
tcp.flags.reset eq 1]</div>
<div class="x_ContentPasted0">Ethernet II, Src: xxx, Dst:
xxx</div>
<div class="x_ContentPasted0"> Destination: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Source: xxx</div>
<div class="x_ContentPasted0"> Address: xxx</div>
<div class="x_ContentPasted0"> .... ..0. .... ....
.... .... = LG bit: Globally unique address (factory
default)</div>
<div class="x_ContentPasted0"> .... ...0 .... ....
.... .... = IG bit: Individual address (unicast)</div>
<div class="x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_ContentPasted0"> Trailer: 00003b22a540</div>
<div class="x_ContentPasted0">Internet Protocol Version 4,
Src: x.y.w.z, Dst: x.y.w.z</div>
<div class="x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_ContentPasted0"> .... 0101 = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Differentiated Services
Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_ContentPasted0"> 0000 00.. =
Differentiated Services Codepoint: Default (0)</div>
<div class="x_ContentPasted0"> .... ..00 = Explicit
Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_ContentPasted0"> Total Length: 40</div>
<div class="x_ContentPasted0"> Identification: 0xd52f
(54575)</div>
<div class="x_ContentPasted0"> 010. .... = Flags: 0x2,
Don't fragment</div>
<div class="x_ContentPasted0"> 0... .... = Reserved
bit: Not set</div>
<div class="x_ContentPasted0"> .1.. .... = Don't
fragment: Set</div>
<div class="x_ContentPasted0"> ..0. .... = More
fragments: Not set</div>
<div class="x_ContentPasted0"> ...0 0000 0000 0000 =
Fragment Offset: 0</div>
<div class="x_ContentPasted0"> Time to Live: 52</div>
<div class="x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_ContentPasted0"> Header Checksum: 0x319d
[validation disabled]</div>
<div class="x_ContentPasted0"> [Header checksum status:
Unverified]</div>
<div class="x_ContentPasted0"> Source Address: x.y.w.z</div>
<div class="x_ContentPasted0"> Destination Address:
x.y.w.z</div>
<div class="x_ContentPasted0">Transmission Control
Protocol, Src Port: xxx, Dst Port: 34986, Seq: 5751,
Len: 0</div>
<div class="x_ContentPasted0"> Source Port: xxx</div>
<div class="x_ContentPasted0"> Destination Port: 34986</div>
<div class="x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_ContentPasted0"> [Conversation
completeness: Complete, WITH_DATA (63)]</div>
<div class="x_ContentPasted0"> [TCP Segment Len: 0]</div>
<div class="x_ContentPasted0"> Sequence Number: 5751
(relative sequence number)</div>
<div class="x_ContentPasted0"> Sequence Number (raw):
2509794850</div>
<div class="x_ContentPasted0"> [Next Sequence Number:
5751 (relative sequence number)]</div>
<div class="x_ContentPasted0"> Acknowledgment Number: 0</div>
<div class="x_ContentPasted0"> Acknowledgment number
(raw): 0</div>
<div class="x_ContentPasted0"> 0101 .... = Header
Length: 20 bytes (5)</div>
<div class="x_ContentPasted0"> Flags: 0x004 (RST)</div>
<div class="x_ContentPasted0"> 000. .... .... =
Reserved: Not set</div>
<div class="x_ContentPasted0"> ...0 .... .... =
Accurate ECN: Not set</div>
<div class="x_ContentPasted0"> .... 0... .... =
Congestion Window Reduced: Not set</div>
<div class="x_ContentPasted0"> .... .0.. .... =
ECN-Echo: Not set</div>
<div class="x_ContentPasted0"> .... ..0. .... =
Urgent: Not set</div>
<div class="x_ContentPasted0"> .... ...0 .... =
Acknowledgment: Not set</div>
<div class="x_ContentPasted0"> .... .... 0... =
Push: Not set</div>
<div class="x_ContentPasted0"> .... .... .1.. =
Reset: Set</div>
<div class="x_ContentPasted0"> .... .... ..0. =
Syn: Not set</div>
<div class="x_ContentPasted0"> .... .... ...0 =
Fin: Not set</div>
<div class="x_ContentPasted0"> [TCP Flags:
·········R··]</div>
<div class="x_ContentPasted0"> Window: 0</div>
<div class="x_ContentPasted0"> [Calculated window size:
0]</div>
<div class="x_ContentPasted0"> [Window size scaling
factor: 16384]</div>
<div class="x_ContentPasted0"> Checksum: 0xd1cb
[unverified]</div>
<div class="x_ContentPasted0"> [Checksum Status:
Unverified]</div>
<div class="x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_ContentPasted0"> [Timestamps]</div>
<div class="x_ContentPasted0"> [Time since first
frame in this TCP stream: 22.119925000 seconds]</div>
<div class="x_ContentPasted0"> [Time since previous
frame in this TCP stream: 0.002535000 seconds]</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_elementToProof">I have other log collections
working fine with TLS.</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">Can you please give me some
hint what could cause this?</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">Thank you.</div>
<div><br class="x_ContentPasted0">
</div>
<div class="x_ContentPasted0">Br,</div>
Dragan<br>
</div>
<div class="x_elementToProof">
<div id="x_Signature">
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
<br>
</body>
</html>