Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 8 replies
  • Subscribers 0 subscribers
  • Views 3223 views
  • Users 0 members are here
Options
Suggested

[7.390] Web browsing and "The connection has been reset" message.

WaMaR
Hi,

From version 7.390 when I browse Webs I have many times "The connection has been reset" message (FireFox). I use http proxy in transparent mode but after turn off issue still persist.

Regards,
WaMaR
  • 0
    Check the IPS and PacketFilter logs and see if you can match the logs against your surfing.

    Barry
  • 0 in reply to BarryG
    IPS and PacketFilter logs looks OK. I can't match the logs against my surfing. Only when I turn on http proxy, I saw strange big time when statuscode is 304: 

    statuscode="304" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="0" time="29488 ms"

    Maybe this is a tip.


    2009:02:17-09:23:55 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="200" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="231" time="1476 ms" request="0x822e270" url="www.samsung.pl/.../html"
    2009:02:17-09:24:25 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="304" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="0" time="29488 ms" request="0x822e270" url="www.samsung.pl/.../Hardware"
    2009:02:17-09:24:26 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="404" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="207" time="1547 ms" request="0x822e270" url="www.samsung.pl/.../html"
    2009:02:17-09:24:30 fw httpproxy[18886]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.13" user="" statuscode="404" cached="0" profile="REF_nRGvdTOQSs (Office (LAN))" filteraction="REF_JZBydGicmp (Lite at work)" size="207" time="1094 ms" request="0xb091bf90" url="www.samsung.pl/.../html" 
  • 0 in reply to WaMaR
    Hello,

    Wireshark shows RST flags in TCP packets.

    What going on?
  • 0 in reply to WaMaR
    I reported this happening with a particular website and 7.306 ... Astaro support told me that some web servers, for some reason, send a RST after the inital connection, which the proxy dutifully reports as "Connection has been Reset" ... the real problem (at least in my case) lies with the web server, and not the Astaro Proxy.

    So... does this "Connection has been reset" error happen on all web sites, or just a select few?

    Oh, and what is the URL that you are using for the site you are showing RST packets for above?  It looks to be in something other than english when I go to it using the IP... but it does come up OK in 7.306.  Perhaps I need to use the URL.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0 in reply to BrucekConvergent
    Strange things but probably issue is with all Web pages for all computers in the same time while few seconds. In this example was for URL Wirtualna Polska - www.wp.pl. When I turn off transparent proxy is better now. Tomorrow I will continue investigation with transparent proxy off.

    Best Regards,
    WaMaR
  • 0 in reply to WaMaR
    OK... I'm running Proxy in standard mode... it may be a transparent proxy issue of some sort...

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0 in reply to BrucekConvergent
    When all day transparent Proxy was turn off then issue is gone.
    Problem is with transparent proxy in this case.
  • 0 in reply to WaMaR
    After upgrade to 7.395 I can use http transparent proxy and my issue is gone. Update 7.395 fix it.

    Regards,
    WaMaR
Unfiltered HTML