Skip to content

Normal Closing Connection

Jump to bottom
Malcolm Stewart edited this page Jun 24, 2021 · 3 revisions

Normal Closing Connection

This page has some variations on the normal connection close.

Just the closing packets

Frame Offset    Source IP    Dest IP      Description
----- --------- ------------ ------------ ---------------------------------------------------------------------------
   50 4.1529661 10.10.10.104  10.10.10.22 TCP:Flags=...A...F, SrcPort=4657, DstPort=1433, PayloadLen=0, Seq=413460761
   51 4.1529661  10.10.10.22 10.10.10.104 TCP:Flags=...A...., SrcPort=1433, DstPort=4657, PayloadLen=0, Seq=280398321
   52 4.1529661  10.10.10.22 10.10.10.104 TCP:Flags=...A...F, SrcPort=1433, DstPort=4657, PayloadLen=0, Seq=280398321
   54 4.2330441 10.10.10.104  10.10.10.22 TCP:Flags=...A...., SrcPort=4657, DstPort=1433, PayloadLen=0, Seq=413460761

Note the low Frame numbers and time offsets. This is most likely a pooled connection being closed by the connection pool. This should occur within 30 seconds of the beginning of the trace or we should see Keep-Alive packets as well.

SQL Statements and closing packets

Frame Offset    Source IP    Dest IP      Description
----- --------- ------------ ------------ ---------------------------------------------------------------------------
  364 9.1949581 10.10.10.104  10.10.10.22 TDS:SQLBatch, Version = 7.300000, SPID = 0, PacketID = 1, Flags=...AP..., S
  365 9.1949581  10.10.10.22 10.10.10.104 TDS:Response, Version = 7.300000, SPID = 130, PacketID = 1, Flags=...AP...,
  366 9.3043331 10.10.10.104  10.10.10.22 TDS:SQLBatch, Version = 7.300000, SPID = 0, PacketID = 1, Flags=...AP..., S
  367 9.3072631  10.10.10.22 10.10.10.104 TDS:Response, Version = 7.300000, SPID = 130, PacketID = 1, Flags=...AP...,
  375 9.4078491 10.10.10.104  10.10.10.22 TCP:Flags=...A...F, SrcPort=4647, DstPort=1433, PayloadLen=0, Seq=157672648
  376 9.4078491  10.10.10.22 10.10.10.104 TCP:Flags=...A...., SrcPort=1433, DstPort=4647, PayloadLen=0, Seq=192890973
  379 9.4078491  10.10.10.22 10.10.10.104 TCP:Flags=...A...F, SrcPort=1433, DstPort=4647, PayloadLen=0, Seq=192890973
  397 9.5221071 10.10.10.104  10.10.10.22 TCP:Flags=...A...., SrcPort=4647, DstPort=1433, PayloadLen=0, Seq=157672649

This is a non-pooled connection or we should see Keep-Alive packets associated with sending the connection back into the connection pool instead of the closing packets immediately following the last response from the server. Pooling of connections is recommended in any sort of web or service application to allow connection re-use, reducing the number of connections to the server, and minimizing the cost and delay associate with new connections.

Idle or pooled connection being closed

Frame Offset     Delta      Source IP   Dest IP     Description
----- ---------- ---------- ----------- ----------- ----------------------------------------------------------------------------
 1314 16.3641802  0.0000000 10.10.10.45 10.10.10.51 TCP:[Keep alive]Flags=...A...., SrcPort=51708, DstPort=1433, PayloadLen=1, S
 1317 16.3677083  0.0035281 10.10.10.51 10.10.10.45 TCP:[Keep alive ack]Flags=...A...., SrcPort=1433, DstPort=51708, PayloadLen=
 1327 16.4269375  0.0592292 10.10.10.51 10.10.10.45 TCP:[Keep alive]Flags=...A...., SrcPort=1433, DstPort=51708, PayloadLen=1, S
 1328 16.4269637  0.0000262 10.10.10.45 10.10.10.51 TCP:[Keep alive ack]Flags=...A...., SrcPort=51708, DstPort=1433, PayloadLen=
 1881 26.7918499 10.3648862 10.10.10.45 10.10.10.51 TCP:[Keep alive ack]Flags=...A...F, SrcPort=51708, DstPort=1433, PayloadLen
 1886 26.7929474  0.0010975 10.10.10.51 10.10.10.45 TCP:Flags=...A...., SrcPort=1433, DstPort=51708, PayloadLen=0, Seq=343858778
 1888 26.7929474  0.0000000 10.10.10.51 10.10.10.45 TCP:Flags=...A...F, SrcPort=1433, DstPort=51708, PayloadLen=0, Seq=343858778
 1890 26.7929947  0.0000473 10.10.10.45 10.10.10.51 TCP:Flags=...A...., SrcPort=51708, DstPort=1433, PayloadLen=0, Seq=409262060

The connection is closed 10 seconds after the previous Keep-Alive exchange (see Delta column). Note: The parser mistakenly marks the initial ACK+FIN packet (Frame 1881) as a Keep alive ack packet due to the prior Keep-Alive packet, but looking at the flags, we can see it is initializing the connection closure.

Clone this wiki locally