<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Hi Steve and Evan,</div>
<div class="elementToProof">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Sorry for the delay, I was on a sick leave.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Thanks for the ideas.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
It seems you are wright, there is an error in front of connection closed:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
Feb 10 15:08:02 xxx syslog-ng[21262]: Invalid frame header; header=''<br class="ContentPasted0">
Feb 10 15:08:02 xxx syslog-ng[21262]: Syslog connection closed; fd='468', client='AF_INET(x.y.z.w:xxx)', local='AF_INET(0.0.0.0:xxx)'<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
It seems there is no frame header in incoming syslog messages.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
I found this in syslog-ng docs:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
syslog-protocol: The syslog-protocol flag instructs the driver to format the messages according to the new IETF syslog protocol standard (RFC5424), but without the frame header. If this flag is enabled, macros used for the message have effect only for the text
of the message, the message header is formatted to the new standard. Note that this flag is not needed for the syslog driver, and that the syslog driver automatically adds the frame header to the messages.
<div><br class="ContentPasted1">
</div>
syslog-protocol: The syslog-protocol flag specifies that incoming messages are expected to be formatted according to the new IETF syslog protocol standard (RFC5424), but without the frame header. Note that this flag is not needed for the syslog driver, which
handles only messages that have a frame header.<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
As I understand syslog driver for RFC5425 doesn't support messages without frame header.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
So should I then use network driver with syslog-protocol flag in combination with RFC3164 messages?</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
Thank you.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
Br,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
Dragan</div>
<div id="Signature"><br>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Evan Rempel <erempel@uvic.ca><br>
<b>Sent:</b> Thursday, February 23, 2023 2:17 PM<br>
<b>To:</b> syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] syslog-ng reset connection before data transfer</font>
<div> </div>
</div>
<div>
<div class="x_moz-cite-prefix">I had an issue with they symptom of the connection closing as the first message was sent. If eventually came down to the packet framing. When using syslog protocol (RFC 5424/5425) you must use framing. Without it syslog-ng drops
the connection.</div>
<div class="x_moz-cite-prefix"><br>
</div>
<div class="x_moz-cite-prefix">As Steve says, look for errors from the receiving syslog-ng process. There should be an error immediately preceding the closed connection.</div>
<div class="x_moz-cite-prefix"><br>
</div>
<div class="x_moz-cite-prefix">Evan.<br>
</div>
<div class="x_moz-cite-prefix"><br>
</div>
<div class="x_moz-cite-prefix">On 2023-02-23 05:33, Steve Bernacki wrote:<br>
</div>
<blockquote type="cite"><br>
<div>
<p>Dragan,</p>
<p><br>
</p>
<p>1) Are you seeing any error or diagnostic message immediately before "Syslog connection closed"? If a log message immediately precedes this message with the same timestamp, it's usually related even though there's nothing in the two entries to tie them together.</p>
<p><br>
</p>
<p>2) Are the clients running syslog-ng?</p>
<p><br>
</p>
<p>3) Any other similarities with the clients that are not working, e.g. on the same network segment etc? Could there be some type of network IDS device sniping these connections?</p>
<p><br>
</p>
<p>Steve<br>
</p>
<p><br>
</p>
<div class="x_moz-cite-prefix">On 2/23/2023 3:40 AM, Dragan Zecevic wrote:<br>
</div>
<blockquote type="cite"><style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div class="x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div class="x_elementToProof">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_Signature" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Hi again,</div>
<div id="x_Signature" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Does somebody have an idea on this?</div>
<div id="x_Signature" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div id="x_Signature" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Thank you.</div>
<div id="x_Signature" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div id="x_Signature" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Br,</div>
<div id="x_Signature" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Dragan</div>
<div><br>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> syslog-ng
<a class="x_moz-txt-link-rfc2396E" href="mailto:syslog-ng-bounces@lists.balabit.hu">
<syslog-ng-bounces@lists.balabit.hu></a> on behalf of Dragan Zecevic <a class="x_moz-txt-link-rfc2396E" href="mailto:dragan.zecevic@live.com">
<dragan.zecevic@live.com></a><br>
<b>Sent:</b> Tuesday, February 14, 2023 2:33 PM<br>
<b>To:</b> <a class="x_moz-txt-link-abbreviated x_moz-txt-link-freetext" href="mailto:syslog-ng@lists.balabit.hu">
syslog-ng@lists.balabit.hu</a> <a class="x_moz-txt-link-rfc2396E" href="mailto:syslog-ng@lists.balabit.hu">
<syslog-ng@lists.balabit.hu></a><br>
<b>Subject:</b> [syslog-ng] syslog-ng reset connection before data transfer</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div class="x_x_elementToProof x_x_ContentPasted0" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<div class="x_x_ContentPasted0 x_x_elementToProof">Hi everybody,</div>
<div class="x_x_ContentPasted0 x_x_elementToProof">I hope you are well.</div>
<div class="x_x_ContentPasted0 x_x_elementToProof"><br>
</div>
<div class="x_x_ContentPasted0 x_x_elementToProof">I was hoping if you can help me with some issue.</div>
<div class="x_x_ContentPasted0">I am trying to collect logs from some servers via syslog.</div>
<div class="x_x_ContentPasted0">TLS session seems to be established - handshake, certs, ciphers all looking ok.</div>
<div class="x_x_ContentPasted0">But when data need to be send it seems syslog-ng server disconnects the session from some reason.</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">In /var/log/messages I can only see start/stop messages even after turning on verbose logging:</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">Feb 10 16:11:48 xxx syslog-ng[21262]: Syslog connection accepted; fd='175', client='AF_INET(x.y.w.z:34986)', local='AF_INET(0.0.0.0:xxx)'</div>
<div class="x_x_ContentPasted0">Feb 10 16:11:49 xxx syslog-ng[21262]: Syslog connection closed; fd='175', client='AF_INET(x.y.w.z:34986)', local='AF_INET(0.0.0.0:xxx)'</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">This is the configuration I am using:</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">source s_xxx {</div>
<div class="x_x_ContentPasted0"> syslog(</div>
<div class="x_x_ContentPasted0"> ip(0.0.0.0)</div>
<div class="x_x_ContentPasted0"> port(xxx)</div>
<div class="x_x_ContentPasted0"> transport("tls")</div>
<div class="x_x_ContentPasted0"> tls(</div>
<div class="x_x_ContentPasted0"> key-file("/etc/syslog-ng/key.d/xxx.key")</div>
<div class="x_x_ContentPasted0"> cert-file("/etc/syslog-ng/cert.d/xxx.cer")</div>
<div class="x_x_ContentPasted0"> ca-dir("/etc/syslog-ng/ca.d")</div>
<div class="x_x_ContentPasted0"> peer-verify(required-trusted)</div>
<div class="x_x_ContentPasted0"> cipher-suite("xxx...xxx")</div>
<div class="x_x_ContentPasted0"> )</div>
<div class="x_x_ContentPasted0"> flags(store-raw-message)</div>
<div class="x_x_ContentPasted0"> );</div>
<div class="x_x_ContentPasted0">};</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">filter filter_xxx {</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0"> host("xxx") ... or host("xxx");</div>
<div class="x_x_ContentPasted0">};</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">destination folder_xxx {</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0"> file(</div>
<div class="x_x_ContentPasted0"> "/var/log/xxx/${R_YEAR}${R_MONTH}${R_DAY}/${SOURCEIP}_${HOST}_${R_HOUR}.log"</div>
<div class="x_x_ContentPasted0"> template("${RAWMSG}\n")</div>
<div class="x_x_ContentPasted0"> dir-group(xxx)</div>
<div class="x_x_ContentPasted0"> dir-perm(0650)</div>
<div class="x_x_ContentPasted0"> group(xxx)</div>
<div class="x_x_ContentPasted0"> );</div>
<div class="x_x_ContentPasted0">};</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">log {</div>
<div class="x_x_ContentPasted0"> source(s_xxx); filter(filter_xxx); destination(folder_xxx); flags(flow-control);</div>
<div class="x_x_ContentPasted0">};</div>
<div><br class="x_x_ContentPasted0">
</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">And bellow is last part of the session captured with tcpdump from source side.</div>
<div class="x_x_ContentPasted0 x_x_elementToProof">It is interesting to me that there is 1h offset comparing to /var/log/messages on syslog-ng. Src and dst server are in same environment.</div>
<div><br class="x_x_ContentPasted0">
</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">24 2023-02-10 15:11:49,073335 x.y.w.z x.y.w.z TLSv1.2 445 Application Data</div>
<div class="x_x_ContentPasted0">Frame 24: 445 bytes on wire (3560 bits), 445 bytes captured (3560 bits)</div>
<div class="x_x_ContentPasted0"> Encapsulation type: Ethernet (1)</div>
<div class="x_x_ContentPasted0"> Arrival Time: Feb 10, 2023 15:11:49.073335000 Central Europe Standard Time</div>
<div class="x_x_ContentPasted0"> [Time shift for this packet: 0.000000000 seconds]</div>
<div class="x_x_ContentPasted0"> Epoch Time: 1676038309.073335000 seconds</div>
<div class="x_x_ContentPasted0"> [Time delta from previous captured frame: 0.906559000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time delta from previous displayed frame: 0.906559000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since reference or first frame: 6.775677000 seconds]</div>
<div class="x_x_ContentPasted0"> Frame Number: 24</div>
<div class="x_x_ContentPasted0"> Frame Length: 445 bytes (3560 bits)</div>
<div class="x_x_ContentPasted0"> Capture Length: 445 bytes (3560 bits)</div>
<div class="x_x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_x_ContentPasted0"> [Frame is ignored: False]</div>
<div class="x_x_ContentPasted0"> [Protocols in frame: eth:ethertype:ip:tcp:tls]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule Name: TCP]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule String: tcp]</div>
<div class="x_x_ContentPasted0">Ethernet II, Src: xxx, Dst: xxx</div>
<div class="x_x_ContentPasted0"> Destination: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Source: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_x_ContentPasted0">Internet Protocol Version 4, Src: x.y.z.w, Dst: x.y.z.w</div>
<div class="x_x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_x_ContentPasted0"> .... 0101 = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_x_ContentPasted0"> 0000 00.. = Differentiated Services Codepoint: Default (0)</div>
<div class="x_x_ContentPasted0"> .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_x_ContentPasted0"> Total Length: 431</div>
<div class="x_x_ContentPasted0"> Identification: 0xeebc (61116)</div>
<div class="x_x_ContentPasted0"> 010. .... = Flags: 0x2, Don't fragment</div>
<div class="x_x_ContentPasted0"> 0... .... = Reserved bit: Not set</div>
<div class="x_x_ContentPasted0"> .1.. .... = Don't fragment: Set</div>
<div class="x_x_ContentPasted0"> ..0. .... = More fragments: Not set</div>
<div class="x_x_ContentPasted0"> ...0 0000 0000 0000 = Fragment Offset: 0</div>
<div class="x_x_ContentPasted0"> Time to Live: 64</div>
<div class="x_x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_x_ContentPasted0"> Header Checksum: 0x0a89 [validation disabled]</div>
<div class="x_x_ContentPasted0"> [Header checksum status: Unverified]</div>
<div class="x_x_ContentPasted0"> Source Address: x.y.z.w</div>
<div class="x_x_ContentPasted0"> Destination Address: x.y.z.w</div>
<div class="x_x_ContentPasted0">Transmission Control Protocol, Src Port: 34986, Dst Port: xxx, Seq: 2380, Ack: 5750, Len: 391</div>
<div class="x_x_ContentPasted0"> Source Port: 34986</div>
<div class="x_x_ContentPasted0"> Destination Port: xxx</div>
<div class="x_x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_x_ContentPasted0"> [Conversation completeness: Complete, WITH_DATA (63)]</div>
<div class="x_x_ContentPasted0"> [TCP Segment Len: 391]</div>
<div class="x_x_ContentPasted0"> Sequence Number: 2380 (relative sequence number)</div>
<div class="x_x_ContentPasted0"> Sequence Number (raw): 2630184540</div>
<div class="x_x_ContentPasted0"> [Next Sequence Number: 2771 (relative sequence number)]</div>
<div class="x_x_ContentPasted0"> Acknowledgment Number: 5750 (relative ack number)</div>
<div class="x_x_ContentPasted0"> Acknowledgment number (raw): 2509794849</div>
<div class="x_x_ContentPasted0"> 0101 .... = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Flags: 0x018 (PSH, ACK)</div>
<div class="x_x_ContentPasted0"> 000. .... .... = Reserved: Not set</div>
<div class="x_x_ContentPasted0"> ...0 .... .... = Accurate ECN: Not set</div>
<div class="x_x_ContentPasted0"> .... 0... .... = Congestion Window Reduced: Not set</div>
<div class="x_x_ContentPasted0"> .... .0.. .... = ECN-Echo: Not set</div>
<div class="x_x_ContentPasted0"> .... ..0. .... = Urgent: Not set</div>
<div class="x_x_ContentPasted0"> .... ...1 .... = Acknowledgment: Set</div>
<div class="x_x_ContentPasted0"> .... .... 1... = Push: Set</div>
<div class="x_x_ContentPasted0"> .... .... .0.. = Reset: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ..0. = Syn: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ...0 = Fin: Not set</div>
<div class="x_x_ContentPasted0"> [TCP Flags: ·······AP···]</div>
<div class="x_x_ContentPasted0"> Window: 318</div>
<div class="x_x_ContentPasted0"> [Calculated window size: 40704]</div>
<div class="x_x_ContentPasted0"> [Window size scaling factor: 128]</div>
<div class="x_x_ContentPasted0"> Checksum: 0x41a5 [unverified]</div>
<div class="x_x_ContentPasted0"> [Checksum Status: Unverified]</div>
<div class="x_x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_x_ContentPasted0"> [Timestamps]</div>
<div class="x_x_ContentPasted0"> [Time since first frame in this TCP stream: 1.007330000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since previous frame in this TCP stream: 0.906559000 seconds]</div>
<div class="x_x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_x_ContentPasted0"> [iRTT: 0.003010000 seconds]</div>
<div class="x_x_ContentPasted0"> [Bytes in flight: 391]</div>
<div class="x_x_ContentPasted0"> [Bytes sent since last PSH flag: 391]</div>
<div class="x_x_ContentPasted0"> TCP payload (391 bytes)</div>
<div class="x_x_ContentPasted0">Transport Layer Security</div>
<div class="x_x_ContentPasted0"> TLSv1.2 Record Layer: Application Data Protocol: Application Data</div>
<div class="x_x_ContentPasted0"> Content Type: Application Data (23)</div>
<div class="x_x_ContentPasted0"> Version: TLS 1.2 (0x0303)</div>
<div class="x_x_ContentPasted0"> Length: 386</div>
<div class="x_x_ContentPasted0"> Encrypted Application Data: 000000000000000146f17ff0e884c81f9317ba9e01c3b48763944e3905fb27fc96ce76fc…</div>
<div><br class="x_x_ContentPasted0">
</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">25 2023-02-10 15:11:49,076214 x.y.z.w x.y.z.w TCP 60 xxx → 34986 [FIN, ACK] Seq=5750 Ack=2771 Win=65536 Len=0</div>
<div class="x_x_ContentPasted0">Frame 25: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)</div>
<div class="x_x_ContentPasted0"> Encapsulation type: Ethernet (1)</div>
<div class="x_x_ContentPasted0"> Arrival Time: Feb 10, 2023 15:11:49.076214000 Central Europe Standard Time</div>
<div class="x_x_ContentPasted0"> [Time shift for this packet: 0.000000000 seconds]</div>
<div class="x_x_ContentPasted0"> Epoch Time: 1676038309.076214000 seconds</div>
<div class="x_x_ContentPasted0"> [Time delta from previous captured frame: 0.002879000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time delta from previous displayed frame: 0.002879000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since reference or first frame: 6.778556000 seconds]</div>
<div class="x_x_ContentPasted0"> Frame Number: 25</div>
<div class="x_x_ContentPasted0"> Frame Length: 60 bytes (480 bits)</div>
<div class="x_x_ContentPasted0"> Capture Length: 60 bytes (480 bits)</div>
<div class="x_x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_x_ContentPasted0"> [Frame is ignored: False]</div>
<div class="x_x_ContentPasted0"> [Protocols in frame: eth:ethertype:ip:tcp]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule Name: TCP SYN/FIN]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]</div>
<div class="x_x_ContentPasted0">Ethernet II, Src: xxx, Dst: xxx</div>
<div class="x_x_ContentPasted0"> Destination: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Source: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_x_ContentPasted0"> Trailer: 000085725dce</div>
<div class="x_x_ContentPasted0">Internet Protocol Version 4, Src: x.y.z.w, Dst: x.y.z.w</div>
<div class="x_x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_x_ContentPasted0"> .... 0101 = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_x_ContentPasted0"> 0000 00.. = Differentiated Services Codepoint: Default (0)</div>
<div class="x_x_ContentPasted0"> .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_x_ContentPasted0"> Total Length: 40</div>
<div class="x_x_ContentPasted0"> Identification: 0xea10 (59920)</div>
<div class="x_x_ContentPasted0"> 010. .... = Flags: 0x2, Don't fragment</div>
<div class="x_x_ContentPasted0"> 0... .... = Reserved bit: Not set</div>
<div class="x_x_ContentPasted0"> .1.. .... = Don't fragment: Set</div>
<div class="x_x_ContentPasted0"> ..0. .... = More fragments: Not set</div>
<div class="x_x_ContentPasted0"> ...0 0000 0000 0000 = Fragment Offset: 0</div>
<div class="x_x_ContentPasted0"> Time to Live: 52</div>
<div class="x_x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_x_ContentPasted0"> Header Checksum: 0x1cbc [validation disabled]</div>
<div class="x_x_ContentPasted0"> [Header checksum status: Unverified]</div>
<div class="x_x_ContentPasted0"> Source Address: x.y.z.w</div>
<div class="x_x_ContentPasted0"> Destination Address: x.y.z.w</div>
<div class="x_x_ContentPasted0">Transmission Control Protocol, Src Port: xxx, Dst Port: 34986, Seq: 5750, Ack: 2771, Len: 0</div>
<div class="x_x_ContentPasted0"> Source Port: xxx</div>
<div class="x_x_ContentPasted0"> Destination Port: 34986</div>
<div class="x_x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_x_ContentPasted0"> [Conversation completeness: Complete, WITH_DATA (63)]</div>
<div class="x_x_ContentPasted0"> [TCP Segment Len: 0]</div>
<div class="x_x_ContentPasted0"> Sequence Number: 5750 (relative sequence number)</div>
<div class="x_x_ContentPasted0"> Sequence Number (raw): 2509794849</div>
<div class="x_x_ContentPasted0"> [Next Sequence Number: 5751 (relative sequence number)]</div>
<div class="x_x_ContentPasted0"> Acknowledgment Number: 2771 (relative ack number)</div>
<div class="x_x_ContentPasted0"> Acknowledgment number (raw): 2630184931</div>
<div class="x_x_ContentPasted0"> 0101 .... = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Flags: 0x011 (FIN, ACK)</div>
<div class="x_x_ContentPasted0"> 000. .... .... = Reserved: Not set</div>
<div class="x_x_ContentPasted0"> ...0 .... .... = Accurate ECN: Not set</div>
<div class="x_x_ContentPasted0"> .... 0... .... = Congestion Window Reduced: Not set</div>
<div class="x_x_ContentPasted0"> .... .0.. .... = ECN-Echo: Not set</div>
<div class="x_x_ContentPasted0"> .... ..0. .... = Urgent: Not set</div>
<div class="x_x_ContentPasted0"> .... ...1 .... = Acknowledgment: Set</div>
<div class="x_x_ContentPasted0"> .... .... 0... = Push: Not set</div>
<div class="x_x_ContentPasted0"> .... .... .0.. = Reset: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ..0. = Syn: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ...1 = Fin: Set</div>
<div class="x_x_ContentPasted0"> [TCP Flags: ·······A···F]</div>
<div class="x_x_ContentPasted0"> Window: 4</div>
<div class="x_x_ContentPasted0"> [Calculated window size: 65536]</div>
<div class="x_x_ContentPasted0"> [Window size scaling factor: 16384]</div>
<div class="x_x_ContentPasted0"> Checksum: 0xc512 [unverified]</div>
<div class="x_x_ContentPasted0"> [Checksum Status: Unverified]</div>
<div class="x_x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_x_ContentPasted0"> [Timestamps]</div>
<div class="x_x_ContentPasted0"> [Time since first frame in this TCP stream: 1.010209000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since previous frame in this TCP stream: 0.002879000 seconds]</div>
<div class="x_x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_x_ContentPasted0"> [This is an ACK to the segment in frame: 24]</div>
<div class="x_x_ContentPasted0"> [The RTT to ACK the segment was: 0.002879000 seconds]</div>
<div class="x_x_ContentPasted0"> [iRTT: 0.003010000 seconds]</div>
<div><br class="x_x_ContentPasted0">
</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">26 2023-02-10 15:11:49,117776 x.y.z.w x.y.z.w TCP 54 34986 → xxx [ACK] Seq=2771 Ack=5751 Win=40704 Len=0</div>
<div class="x_x_ContentPasted0">Frame 26: 54 bytes on wire (432 bits), 54 bytes captured (432 bits)</div>
<div class="x_x_ContentPasted0"> Encapsulation type: Ethernet (1)</div>
<div class="x_x_ContentPasted0"> Arrival Time: Feb 10, 2023 15:11:49.117776000 Central Europe Standard Time</div>
<div class="x_x_ContentPasted0"> [Time shift for this packet: 0.000000000 seconds]</div>
<div class="x_x_ContentPasted0"> Epoch Time: 1676038309.117776000 seconds</div>
<div class="x_x_ContentPasted0"> [Time delta from previous captured frame: 0.041562000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time delta from previous displayed frame: 0.041562000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since reference or first frame: 6.820118000 seconds]</div>
<div class="x_x_ContentPasted0"> Frame Number: 26</div>
<div class="x_x_ContentPasted0"> Frame Length: 54 bytes (432 bits)</div>
<div class="x_x_ContentPasted0"> Capture Length: 54 bytes (432 bits)</div>
<div class="x_x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_x_ContentPasted0"> [Frame is ignored: False]</div>
<div class="x_x_ContentPasted0"> [Protocols in frame: eth:ethertype:ip:tcp]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule Name: TCP]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule String: tcp]</div>
<div class="x_x_ContentPasted0">Ethernet II, Src: Mellanox_69:6f:47 (1c:34:da:69:6f:47), Dst: ICANNIAN_00:40:20 (00:00:5e:00:40:20)</div>
<div class="x_x_ContentPasted0"> Destination: ICANNIAN_00:40:20 (00:00:5e:00:40:20)</div>
<div class="x_x_ContentPasted0"> Address: ICANNIAN_00:40:20 (00:00:5e:00:40:20)</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Source: Mellanox_69:6f:47 (1c:34:da:69:6f:47)</div>
<div class="x_x_ContentPasted0"> Address: Mellanox_69:6f:47 (1c:34:da:69:6f:47)</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_x_ContentPasted0">Internet Protocol Version 4, Src: x.y.z.w, Dst: x.y.z.w</div>
<div class="x_x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_x_ContentPasted0"> .... 0101 = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_x_ContentPasted0"> 0000 00.. = Differentiated Services Codepoint: Default (0)</div>
<div class="x_x_ContentPasted0"> .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_x_ContentPasted0"> Total Length: 40</div>
<div class="x_x_ContentPasted0"> Identification: 0xeebd (61117)</div>
<div class="x_x_ContentPasted0"> 010. .... = Flags: 0x2, Don't fragment</div>
<div class="x_x_ContentPasted0"> 0... .... = Reserved bit: Not set</div>
<div class="x_x_ContentPasted0"> .1.. .... = Don't fragment: Set</div>
<div class="x_x_ContentPasted0"> ..0. .... = More fragments: Not set</div>
<div class="x_x_ContentPasted0"> ...0 0000 0000 0000 = Fragment Offset: 0</div>
<div class="x_x_ContentPasted0"> Time to Live: 64</div>
<div class="x_x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_x_ContentPasted0"> Header Checksum: 0x0c0f [validation disabled]</div>
<div class="x_x_ContentPasted0"> [Header checksum status: Unverified]</div>
<div class="x_x_ContentPasted0"> Source Address: x.y.z.w</div>
<div class="x_x_ContentPasted0"> Destination Address: x.y.z.w</div>
<div class="x_x_ContentPasted0">Transmission Control Protocol, Src Port: 34986, Dst Port: xxx, Seq: 2771, Ack: 5751, Len: 0</div>
<div class="x_x_ContentPasted0"> Source Port: 34986</div>
<div class="x_x_ContentPasted0"> Destination Port: xxx</div>
<div class="x_x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_x_ContentPasted0"> [Conversation completeness: Complete, WITH_DATA (63)]</div>
<div class="x_x_ContentPasted0"> [TCP Segment Len: 0]</div>
<div class="x_x_ContentPasted0"> Sequence Number: 2771 (relative sequence number)</div>
<div class="x_x_ContentPasted0"> Sequence Number (raw): 2630184931</div>
<div class="x_x_ContentPasted0"> [Next Sequence Number: 2771 (relative sequence number)]</div>
<div class="x_x_ContentPasted0"> Acknowledgment Number: 5751 (relative ack number)</div>
<div class="x_x_ContentPasted0"> Acknowledgment number (raw): 2509794850</div>
<div class="x_x_ContentPasted0"> 0101 .... = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Flags: 0x010 (ACK)</div>
<div class="x_x_ContentPasted0"> 000. .... .... = Reserved: Not set</div>
<div class="x_x_ContentPasted0"> ...0 .... .... = Accurate ECN: Not set</div>
<div class="x_x_ContentPasted0"> .... 0... .... = Congestion Window Reduced: Not set</div>
<div class="x_x_ContentPasted0"> .... .0.. .... = ECN-Echo: Not set</div>
<div class="x_x_ContentPasted0"> .... ..0. .... = Urgent: Not set</div>
<div class="x_x_ContentPasted0"> .... ...1 .... = Acknowledgment: Set</div>
<div class="x_x_ContentPasted0"> .... .... 0... = Push: Not set</div>
<div class="x_x_ContentPasted0"> .... .... .0.. = Reset: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ..0. = Syn: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ...0 = Fin: Not set</div>
<div class="x_x_ContentPasted0"> [TCP Flags: ·······A····]</div>
<div class="x_x_ContentPasted0"> Window: 318</div>
<div class="x_x_ContentPasted0"> [Calculated window size: 40704]</div>
<div class="x_x_ContentPasted0"> [Window size scaling factor: 128]</div>
<div class="x_x_ContentPasted0"> Checksum: 0x401e [unverified]</div>
<div class="x_x_ContentPasted0"> [Checksum Status: Unverified]</div>
<div class="x_x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_x_ContentPasted0"> [Timestamps]</div>
<div class="x_x_ContentPasted0"> [Time since first frame in this TCP stream: 1.051771000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since previous frame in this TCP stream: 0.041562000 seconds]</div>
<div class="x_x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_x_ContentPasted0"> [This is an ACK to the segment in frame: 25]</div>
<div class="x_x_ContentPasted0"> [The RTT to ACK the segment was: 0.041562000 seconds]</div>
<div class="x_x_ContentPasted0"> [iRTT: 0.003010000 seconds]</div>
<div><br class="x_x_ContentPasted0">
</div>
<div><br class="x_x_ContentPasted0">
</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">27 2023-02-10 15:12:10,183395 x.y.w.z x.y.w.z TLSv1.2 457 Application Data</div>
<div class="x_x_ContentPasted0">Frame 27: 457 bytes on wire (3656 bits), 457 bytes captured (3656 bits)</div>
<div class="x_x_ContentPasted0"> Encapsulation type: Ethernet (1)</div>
<div class="x_x_ContentPasted0"> Arrival Time: Feb 10, 2023 15:12:10.183395000 Central Europe Standard Time</div>
<div class="x_x_ContentPasted0"> [Time shift for this packet: 0.000000000 seconds]</div>
<div class="x_x_ContentPasted0"> Epoch Time: 1676038330.183395000 seconds</div>
<div class="x_x_ContentPasted0"> [Time delta from previous captured frame: 21.065619000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time delta from previous displayed frame: 21.065619000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since reference or first frame: 27.885737000 seconds]</div>
<div class="x_x_ContentPasted0"> Frame Number: 27</div>
<div class="x_x_ContentPasted0"> Frame Length: 457 bytes (3656 bits)</div>
<div class="x_x_ContentPasted0"> Capture Length: 457 bytes (3656 bits)</div>
<div class="x_x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_x_ContentPasted0"> [Frame is ignored: False]</div>
<div class="x_x_ContentPasted0"> [Protocols in frame: eth:ethertype:ip:tcp:tls]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule Name: TCP]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule String: tcp]</div>
<div class="x_x_ContentPasted0">Ethernet II, Src: xxx, Dst: xxx</div>
<div class="x_x_ContentPasted0"> Destination: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Source: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_x_ContentPasted0">Internet Protocol Version 4, Src: x.y.w.z, Dst: x.y.w.z</div>
<div class="x_x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_x_ContentPasted0"> .... 0101 = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_x_ContentPasted0"> 0000 00.. = Differentiated Services Codepoint: Default (0)</div>
<div class="x_x_ContentPasted0"> .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_x_ContentPasted0"> Total Length: 443</div>
<div class="x_x_ContentPasted0"> Identification: 0xeebe (61118)</div>
<div class="x_x_ContentPasted0"> 010. .... = Flags: 0x2, Don't fragment</div>
<div class="x_x_ContentPasted0"> 0... .... = Reserved bit: Not set</div>
<div class="x_x_ContentPasted0"> .1.. .... = Don't fragment: Set</div>
<div class="x_x_ContentPasted0"> ..0. .... = More fragments: Not set</div>
<div class="x_x_ContentPasted0"> ...0 0000 0000 0000 = Fragment Offset: 0</div>
<div class="x_x_ContentPasted0"> Time to Live: 64</div>
<div class="x_x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_x_ContentPasted0"> Header Checksum: 0x0a7b [validation disabled]</div>
<div class="x_x_ContentPasted0"> [Header checksum status: Unverified]</div>
<div class="x_x_ContentPasted0"> Source Address: x.y.w.z</div>
<div class="x_x_ContentPasted0"> Destination Address: x.y.w.z</div>
<div class="x_x_ContentPasted0">Transmission Control Protocol, Src Port: 34986, Dst Port: xxx, Seq: 2771, Ack: 5751, Len: 403</div>
<div class="x_x_ContentPasted0"> Source Port: 34986</div>
<div class="x_x_ContentPasted0"> Destination Port: xxx</div>
<div class="x_x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_x_ContentPasted0"> [Conversation completeness: Complete, WITH_DATA (63)]</div>
<div class="x_x_ContentPasted0"> [TCP Segment Len: 403]</div>
<div class="x_x_ContentPasted0"> Sequence Number: 2771 (relative sequence number)</div>
<div class="x_x_ContentPasted0"> Sequence Number (raw): 2630184931</div>
<div class="x_x_ContentPasted0"> [Next Sequence Number: 3174 (relative sequence number)]</div>
<div class="x_x_ContentPasted0"> Acknowledgment Number: 5751 (relative ack number)</div>
<div class="x_x_ContentPasted0"> Acknowledgment number (raw): 2509794850</div>
<div class="x_x_ContentPasted0"> 0101 .... = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Flags: 0x018 (PSH, ACK)</div>
<div class="x_x_ContentPasted0"> 000. .... .... = Reserved: Not set</div>
<div class="x_x_ContentPasted0"> ...0 .... .... = Accurate ECN: Not set</div>
<div class="x_x_ContentPasted0"> .... 0... .... = Congestion Window Reduced: Not set</div>
<div class="x_x_ContentPasted0"> .... .0.. .... = ECN-Echo: Not set</div>
<div class="x_x_ContentPasted0"> .... ..0. .... = Urgent: Not set</div>
<div class="x_x_ContentPasted0"> .... ...1 .... = Acknowledgment: Set</div>
<div class="x_x_ContentPasted0"> .... .... 1... = Push: Set</div>
<div class="x_x_ContentPasted0"> .... .... .0.. = Reset: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ..0. = Syn: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ...0 = Fin: Not set</div>
<div class="x_x_ContentPasted0"> [TCP Flags: ·······AP···]</div>
<div class="x_x_ContentPasted0"> Window: 318</div>
<div class="x_x_ContentPasted0"> [Calculated window size: 40704]</div>
<div class="x_x_ContentPasted0"> [Window size scaling factor: 128]</div>
<div class="x_x_ContentPasted0"> Checksum: 0x41b1 [unverified]</div>
<div class="x_x_ContentPasted0"> [Checksum Status: Unverified]</div>
<div class="x_x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_x_ContentPasted0"> [Timestamps]</div>
<div class="x_x_ContentPasted0"> [Time since first frame in this TCP stream: 22.117390000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since previous frame in this TCP stream: 21.065619000 seconds]</div>
<div class="x_x_ContentPasted0"> [SEQ/ACK analysis]</div>
<div class="x_x_ContentPasted0"> [iRTT: 0.003010000 seconds]</div>
<div class="x_x_ContentPasted0"> [Bytes in flight: 403]</div>
<div class="x_x_ContentPasted0"> [Bytes sent since last PSH flag: 403]</div>
<div class="x_x_ContentPasted0"> TCP payload (403 bytes)</div>
<div class="x_x_ContentPasted0">Transport Layer Security</div>
<div class="x_x_ContentPasted0"> TLSv1.2 Record Layer: Application Data Protocol: Application Data</div>
<div class="x_x_ContentPasted0"> Content Type: Application Data (23)</div>
<div class="x_x_ContentPasted0"> Version: TLS 1.2 (0x0303)</div>
<div class="x_x_ContentPasted0"> Length: 398</div>
<div class="x_x_ContentPasted0"> Encrypted Application Data: 0000000000000002be4aae5822b205849734ad881717619991987bc9817d0b0417781265…</div>
<div><br class="x_x_ContentPasted0">
</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">28 2023-02-10 15:12:10,185930 x.y.w.z x.y.w.z TCP 60 xxx → 34986 [RST] Seq=5751 Win=0 Len=0</div>
<div class="x_x_ContentPasted0">Frame 28: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)</div>
<div class="x_x_ContentPasted0"> Encapsulation type: Ethernet (1)</div>
<div class="x_x_ContentPasted0"> Arrival Time: Feb 10, 2023 15:12:10.185930000 Central Europe Standard Time</div>
<div class="x_x_ContentPasted0"> [Time shift for this packet: 0.000000000 seconds]</div>
<div class="x_x_ContentPasted0"> Epoch Time: 1676038330.185930000 seconds</div>
<div class="x_x_ContentPasted0"> [Time delta from previous captured frame: 0.002535000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time delta from previous displayed frame: 0.002535000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since reference or first frame: 27.888272000 seconds]</div>
<div class="x_x_ContentPasted0"> Frame Number: 28</div>
<div class="x_x_ContentPasted0"> Frame Length: 60 bytes (480 bits)</div>
<div class="x_x_ContentPasted0"> Capture Length: 60 bytes (480 bits)</div>
<div class="x_x_ContentPasted0"> [Frame is marked: False]</div>
<div class="x_x_ContentPasted0"> [Frame is ignored: False]</div>
<div class="x_x_ContentPasted0"> [Protocols in frame: eth:ethertype:ip:tcp]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule Name: TCP RST]</div>
<div class="x_x_ContentPasted0"> [Coloring Rule String: tcp.flags.reset eq 1]</div>
<div class="x_x_ContentPasted0">Ethernet II, Src: xxx, Dst: xxx</div>
<div class="x_x_ContentPasted0"> Destination: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Source: xxx</div>
<div class="x_x_ContentPasted0"> Address: xxx</div>
<div class="x_x_ContentPasted0"> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div class="x_x_ContentPasted0"> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div>
<div class="x_x_ContentPasted0"> Type: IPv4 (0x0800)</div>
<div class="x_x_ContentPasted0"> Trailer: 00003b22a540</div>
<div class="x_x_ContentPasted0">Internet Protocol Version 4, Src: x.y.w.z, Dst: x.y.w.z</div>
<div class="x_x_ContentPasted0"> 0100 .... = Version: 4</div>
<div class="x_x_ContentPasted0"> .... 0101 = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</div>
<div class="x_x_ContentPasted0"> 0000 00.. = Differentiated Services Codepoint: Default (0)</div>
<div class="x_x_ContentPasted0"> .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)</div>
<div class="x_x_ContentPasted0"> Total Length: 40</div>
<div class="x_x_ContentPasted0"> Identification: 0xd52f (54575)</div>
<div class="x_x_ContentPasted0"> 010. .... = Flags: 0x2, Don't fragment</div>
<div class="x_x_ContentPasted0"> 0... .... = Reserved bit: Not set</div>
<div class="x_x_ContentPasted0"> .1.. .... = Don't fragment: Set</div>
<div class="x_x_ContentPasted0"> ..0. .... = More fragments: Not set</div>
<div class="x_x_ContentPasted0"> ...0 0000 0000 0000 = Fragment Offset: 0</div>
<div class="x_x_ContentPasted0"> Time to Live: 52</div>
<div class="x_x_ContentPasted0"> Protocol: TCP (6)</div>
<div class="x_x_ContentPasted0"> Header Checksum: 0x319d [validation disabled]</div>
<div class="x_x_ContentPasted0"> [Header checksum status: Unverified]</div>
<div class="x_x_ContentPasted0"> Source Address: x.y.w.z</div>
<div class="x_x_ContentPasted0"> Destination Address: x.y.w.z</div>
<div class="x_x_ContentPasted0">Transmission Control Protocol, Src Port: xxx, Dst Port: 34986, Seq: 5751, Len: 0</div>
<div class="x_x_ContentPasted0"> Source Port: xxx</div>
<div class="x_x_ContentPasted0"> Destination Port: 34986</div>
<div class="x_x_ContentPasted0"> [Stream index: 1]</div>
<div class="x_x_ContentPasted0"> [Conversation completeness: Complete, WITH_DATA (63)]</div>
<div class="x_x_ContentPasted0"> [TCP Segment Len: 0]</div>
<div class="x_x_ContentPasted0"> Sequence Number: 5751 (relative sequence number)</div>
<div class="x_x_ContentPasted0"> Sequence Number (raw): 2509794850</div>
<div class="x_x_ContentPasted0"> [Next Sequence Number: 5751 (relative sequence number)]</div>
<div class="x_x_ContentPasted0"> Acknowledgment Number: 0</div>
<div class="x_x_ContentPasted0"> Acknowledgment number (raw): 0</div>
<div class="x_x_ContentPasted0"> 0101 .... = Header Length: 20 bytes (5)</div>
<div class="x_x_ContentPasted0"> Flags: 0x004 (RST)</div>
<div class="x_x_ContentPasted0"> 000. .... .... = Reserved: Not set</div>
<div class="x_x_ContentPasted0"> ...0 .... .... = Accurate ECN: Not set</div>
<div class="x_x_ContentPasted0"> .... 0... .... = Congestion Window Reduced: Not set</div>
<div class="x_x_ContentPasted0"> .... .0.. .... = ECN-Echo: Not set</div>
<div class="x_x_ContentPasted0"> .... ..0. .... = Urgent: Not set</div>
<div class="x_x_ContentPasted0"> .... ...0 .... = Acknowledgment: Not set</div>
<div class="x_x_ContentPasted0"> .... .... 0... = Push: Not set</div>
<div class="x_x_ContentPasted0"> .... .... .1.. = Reset: Set</div>
<div class="x_x_ContentPasted0"> .... .... ..0. = Syn: Not set</div>
<div class="x_x_ContentPasted0"> .... .... ...0 = Fin: Not set</div>
<div class="x_x_ContentPasted0"> [TCP Flags: ·········R··]</div>
<div class="x_x_ContentPasted0"> Window: 0</div>
<div class="x_x_ContentPasted0"> [Calculated window size: 0]</div>
<div class="x_x_ContentPasted0"> [Window size scaling factor: 16384]</div>
<div class="x_x_ContentPasted0"> Checksum: 0xd1cb [unverified]</div>
<div class="x_x_ContentPasted0"> [Checksum Status: Unverified]</div>
<div class="x_x_ContentPasted0"> Urgent Pointer: 0</div>
<div class="x_x_ContentPasted0"> [Timestamps]</div>
<div class="x_x_ContentPasted0"> [Time since first frame in this TCP stream: 22.119925000 seconds]</div>
<div class="x_x_ContentPasted0"> [Time since previous frame in this TCP stream: 0.002535000 seconds]</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_elementToProof">I have other log collections working fine with TLS.</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">Can you please give me some hint what could cause this?</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">Thank you.</div>
<div><br class="x_x_ContentPasted0">
</div>
<div class="x_x_ContentPasted0">Br,</div>
Dragan<br>
</div>
<div class="x_x_elementToProof">
<div id="x_x_Signature">
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
<br>
</div>
</body>
</html>