Also the LB Logs doesn't show any issues. I can't do a capture between the server and the LB due to the server being a VM that sits on a host on a different switch where I dont have access to atm. The issue is totally random during the day and not a load or busy period issue.įrom what I can see and read on the internet the LB might be involved with this 3 way handshake even though one would expect this to be between the server and the client. This particular ransomware strain named SynAck or Syn Ack was first spotted on August 3 and experts quickly determined that they were looking at a whole new ransomware strain altogether. I can also confirm I have no packets missing from my wireshark. So it seems either the LB or the server is sending the WRONG SYN,ACK SEQ number? I checked previous TCP streams and also filtered on this wrong SEQ number and can't find it anywhere in my capture so its not something that was stuck in a previous segment or so. Synack is pioneering a trusted, hacker-powered approach to protecting an organization’s cyber-attack surface.

At least SYN packet makes it to our server so I suspect possible a route issue somewhere between us to send the SYN/ACK or. Capture on my ASA shows server receive the SYN and keeps retransmitting with a SYN/ACK until connection is reset. SYN,ACK SEQ(t124124) ACK(124125)Īnd so on until the packet is dropped. So capture on host side shows Syn got out to server on my side. If this was a routing issue, I would expect that either the SYN packet would never reach the server, or that the SYN ACK would be generated but never get routed to the client. I checked 'netstat -a' and verified that the server is listening on port 21 for all IP addresses (0.0.0.0). SYN,ACK SEQ(totally random number 124124) ACK(totally random number + 1 - 124125) There is no SYN/ACK packet being generated in response. When we do a TCP dump between the firewall and loadbalancer we can see the successfull connections which follows the normal 3 way handshake as expected but when we look at the failed transactions we are seeing the follwing The packet traverses as belowĬlient - firewall - ipsec tunnel - firewall - loadbalancer - server

I have been investigating an issue for a month now and still can't figure out what the issue is.īasically we have clients connecting to a server on port 80 but 1% of the connections fail due to a socket error.

Syn ack synack