« Previous Next »

• 06-26-2009, 3:26 PM

  sawozny Joined on 06-26-2009, 7:09 PM Posts 2

  Web server occasionally sending RST Reply Contact Greetings Gurus, I have a Windows 2003 server running IIS 6 and hosting a fairly straightforward ASP based site which consults a database and serves report files for download by our clients.  This environment has only been in production for a couple of weeks and in the last 2 days we've been getting reports of the search results frame occasionally appearing as Page Not Found.  It doesn't occur all the time, but if we get enough sessions going we can eventually replicate the issue.  I did so today while running WireShark and what I saw was that when this occurs the request comes in properly formed (the server responded to it correctly 5 minutes prior) but the server responds this time immediately with a RST packet which the browser interprets correctly as page not found.  The fact this is occuring is odd in and of itself, but what's even odder is that it's a badly formed RST packet.  Per Wireshark: The acknowledge field is nonzero while the ACK flag is not set.  I have seen this type of issue discussed in various forums I found through google searches, but I haven't seen a good resolution.  I thought since the respose is coming from source port 80 I'd see if anyone here had seen IIS do anything like this before or had any further suggestions.  The IIS log files don't appear to contain anything out of the ordinary (all the log lines around that time are status 200). Any help would be greatly appreciated. Thanks, Scott

• 06-27-2009, 1:54 PM

  In reply to

  Rovastar Joined on 03-13-2008, 2:00 PM London, UK Posts 1,798

  Re: Web server occasionally sending RST Reply Contact Could you post the IIS logs? What about the win32 error field? Is anything is the http error logs? If IIS thinks it is sending out the correct information there could be something going wrong with other layer of the network sending. It could be related network card or other comms. ARe you going through any load balancer, etc? http://www.iisportal.com

• 07-09-2009, 6:34 PM

  In reply to

  sawozny Joined on 06-26-2009, 7:09 PM Posts 2

  Re: Web server occasionally sending RST Reply Contact Sadly, I am prohibited from posting the logs in a public forum like this, but I took your advice and dug deeper into the logs rahter than just looking at the 200s reported by IIS.  In the Win32 field I have mostly 0s which is good, but I also have a bunch of 2s, 3s and 64s (which, after researching, appears to be file, path and network resource not found, respectively).  Those indicate that the code may be looking for stuff that's not there (or at least not anymore) but not breaking anything fatally so I've asked the developers to review to code from this persepctive, hopefully reducing this number will make the intermittent issue I'm facing stand out more.  BUT, I did find 15 or 20 win32 status code 22s a day which appears to be "bad command".  As this site is an upgrade from IIS 5 to IIS 6 and uses a completely revamped API to the content management system AND always crops up when running a particular order status aspx page that's where I think my intermittent demon lives so thanks very much for the suggestion.  I'm having the developers do a deep dive into that code to determine the source.  Is there anywhere that more detail about the source of those 22s (or, frankly, any of the non-zero Win32 Status returns) might be found or can be enabled in IIS6? The HTTP error logs showing a number of Timer_MinBytesPerSecond errors (and 1236 Win32 Status erorrs in the IIS log) which I know are caused by my load balancer sending a FIN in once it's seen the string it wants, but before the server has finished sending it the page data during health checks so I'm working on rectifying that situation with them.  Again, hopefully this will help the intermittent error stand out when it happens.  I'd be generally inclined to consider the load balancer at fault, but when I watch the wire at that point I see a perfectly valid post get sent from the load balancer to the server followed immediately by a RST which the load balancer dutifully returns to the requesting client which is why I'm focused on the server itself. Again, thanks for the guidance and if you might know where I can get any further data on the cause of the Win32 Status 22s I'd appreciate it. Thanks, Scott

• 07-10-2009, 8:08 AM

  In reply to

  Rovastar Joined on 03-13-2008, 2:00 PM London, UK Posts 1,798

  Re: Web server occasionally sending RST Reply Contact Aha win32 errors. I thought it might be when you said all teh http status were ok at 200. AS you know now that is not always the case. There is sadly not that much information on the specific details of win32 error codes. I have done a fair amount of research into them but the answers are not always there. Win32 = 64 is common and often will be because of a network issue and I believe many others are related to these issues too. as we go through so many firewalls, routers, load balancers, networks, etc to from client to server. However I have seen it when there is no network issues but, for me, happened every time. Messed up web.config did this. If you can eliminate the network traffic info that is helpful. As you have ideas that you can recreate (one of) these issues see if you can do this on cut of the network. The best way is to open a browser on the server itself. If you can recreate in those conditions (without going out to the load balancer and back in, ) that you know it is something to do with the server. That doesn't mean the app it just means that the server has a problem. Also then try and recreate with a few hops as possible. Going through the load balancer from another server in the farm or from another server in the same subnet, etc. That might help you work out where the problem is occurring. http://www.iisportal.com

• 07-10-2009, 10:03 AM

  In reply to

  Paul Lynch Joined on 05-24-2006, 9:41 AM UK Posts 1,248	Re: Web server occasionally sending RST Reply Contact Hi, This little utility will give you the definition of all the Win32 errors you might ever encounter, but the meanings themselves aren't always particularly helpful : http://gregorybraun.com/MSWinErr.html Regards, Paul Lynch | www.iisadmin.co.uk