Re: Diagnosing disconnect exactly every 10 minutes in online game. FIN/ACK and TCP RST packet problem.

[Michael Holt <m.iostreams () gmail com>]

 Hi Austin,

Just an FYI for future reference, you usually want to save the capture 
file in binary format, rather than ascii text.
From Wireshark, File -> Save As -> somefile.dmp

This makes it a lot easier for someone to open the file in Wireshark and 
see what you are seeing.

 -- Mike

On 9/10/2010 2:09 AM, Martin Visser wrote:
> Receiving a FIN-ACK from the server basically indicates that from 
> server's point of view it is done with that session. Your client 
> ACKnowledges that packet, and also concludes the session from it's 
> end.  The RSTs are probably just the result of your clients packets 
> that were still "in flight" at the time of session termination.
>
> So from a TCP protocol everything is normal, the server had nothing 
> more to tell you on that session, so it ends it.
>
> It could be terminating for any reasons, maybe such as it doesn't 
> believe you are authorised anymore, or the like. I imagine some 
> gameservers might allow you to play with 0 credit for a period of 
> time, or maybe it thinks the game running on your machine isn't genuine.
>
> It could also be that some other device like your firewall or the ISPs 
> firewall is spoofing the server's FIN flag, but this is not likely - 
> unless there was a good reason your ISP wanted to limit your traffic 
> using that game.
>
> I'm not sure if this will help you, might you might be able to think 
> of a reason why you are being dropped by the server.
>
> Regards, Martin
>
> MartinVisser99 () gmail com <mailto:MartinVisser99 () gmail com>
>
>
> On Fri, Sep 10, 2010 at 4:31 PM, Austin Kretzer <austink3d () gmail com 
> <mailto:austink3d () gmail com>> wrote:
>
>     Hello everyone,
>
>     I am trying to find out some help or direction for a problem I am
>     having. I am playing an online game called Final Fantasy XIV, and
>     for some reason every 10 minutes exactly, I get disconnected. My
>     connection quality up to that point is fine, no lag. I don't know
>     much about packets and Wireshark, I just downloaded it today. I
>     have been trying to fix this problem for days now, with no luck. I
>     ran Wireshark and started the game. Everything from my basic
>     knowledge appears normal up to the 10 minute mark where I get this
>     disconnect. I get hit by a FIN,ACK packet from the server for some
>     reason, which my IP then replies with a ACK, and then its own
>     FIN,ACK packet. After that I get four TCP RST packets from the
>     server, and my connection goes down. I have no idea why the server
>     would be doing this, or if its something in my own line doing it.
>     Its the server's IP sending the first packet, but that makes no
>     sense that it would only target me.
>
>     This only happens with this game, I have no problem browsing the
>     internet. I have a 3MB DSL line from TDS. I hooked up my computer
>     to a friends Comcast cable connection and played the game and it
>     worked fine for hours on end, so I know its a connection issue. I
>     have tried everything I know how to do, but I am more of a
>     software and hardware kind of guy. Networking is my weakpoint
>     besides the basics. I haven't found many people at all in the game
>     having the same problem, and I have only found a few issues like
>     this online through google with other games/general issues. I have
>     tried every fix I have found so far with no luck.
>
>     I have a screenshot of what happens at the 10 minute mark, as well
>     as the full capture of my 10 minute connection to the game for all
>     of you to look at.
>
>     Please go to:
>     http://www.ffxivcore.com/topic/14215-error-code-30002-and-3102-13001-and-now-loading-error/page__st__20
>
>     There, I have the image as well as a link to my full capture.
>
>     I hope I am not asking too much, I am just terribly lost with this
>     issue, and I have ran out of ideas and I am to my wits end. Any
>     help or suggestions or anything at all would be greatly
>     appreciated. Thank you for reading!
>
>
>
>     ___________________________________________________________________________
>     Sent via:    Wireshark-users mailing list
>     <wireshark-users () wireshark org <mailto:wireshark-users () wireshark org>>
>     Archives: http://www.wireshark.org/lists/wireshark-users
>     Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>                 mailto:wireshark-users-request () wireshark org
>     <mailto:wireshark-users-request () wireshark org>?subject=unsubscribe
>
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list<wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>               mailto:wireshark-users-request () wireshark org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe