Hello, On Tue, 20 Feb 2024 11:57:27 +0800 Kin Seng <ckins...@gmail.com> wrote:
> Hi J Carter, > > Thank you for your reply. > I am capturing the packet from firewall, and the filtering is as per below > for the previously attached pcap. I see, I assumed you had run tcpdump on the nginx host. I'd reccomend doing that too then (as well as client app host) if you have a network firewall in the mix - to see what nginx itself truely sends/recieves. > Source : client app -- Dest : nginx proxy , any port to any port > > Source : public server -- Dest : nginx proxy , any port to any port > > Source : nginx proxy -- Dest : client app , any port to any port > > Source : nginx proxy -- Dest : public server , any port to any port. > It shouldn't be missing such data then - although again, this may be specific to the firewall itself. > Perhaps I will try to do tcpdump from the client app as well. > > One more info that I notice from client app host, from the netstat command, > it shows CLOSE_WAIT for the terminated session, it seems like close_wait is > the symbol that the closing is from external ( in this case client app is > connect to nginx proxy), is this right? close_wait on client would indicate that the other party initated connection close (sent the first FIN) - again, firewall makes me more skeptical, as it can have it's own timers for closing tcp connection / it's own logic. _______________________________________________ nginx mailing list nginx@nginx.org https://mailman.nginx.org/mailman/listinfo/nginx