Window Socket Application Failure with Connection Reset Event

Last reviewed: May 5, 1997
Article ID: Q152474

The information in this article applies to:

Microsoft Windows NT Workstation versions 3.51
Microsoft Windows NT Server versions 3.51

SYMPTOMS

A Windows Socket (WinSock) application fails to receive data from a remote server. It may display a message indicating that a Connection Reset message or a WSAECONNRESET event occurred.

CAUSE

Under certain circumstances, a condition exists with Microsoft TCP/IP where a TCP packet can be sent on a connection that has already closed causing a Reset packet to be issued. This causes the WinSock application to fail with a WSAECONNRESET event.

Detailed Explanation:

In a normal WinSock client-server TCP/IP communication sequence, the following type of conversation could be observed with a Network Monitor product.

   CLIENT               SERVER
   ======               ======
   SYN         -->
            <--      SYN - ACK
   ACK         -->

   TCP (Data - request) -->
            <--      ACK

            <--      TCP (Data - response)
   ACK         -->

      ... potentially many Data/Ack response packets ...

   FIN         -->
            <--      ACK
            <--      FIN
   ACK         -->

When the final FIN packet is sent by the server, and the ACK packet returns, the server is free to close the socket created for the client communication. In this instance, the client initiated the closing of communications, followed by the server.

In a WinSock client-server TCP/IP communication sequence that exposes the Connection Reset problem, the following type of conversation could be observed with a Network Monitor product.

   CLIENT               SERVER
   ======               ======
   SYN         -->
            <--      SYN - ACK
   ACK         -->

   TCP (Data - request) -->
            <--      ACK

   FIN         -->
            <--      ACK

            <--      TCP (Data - response)
   ACK         -->

      ... potentially many Data/Ack response packets ...

            <--      FIN
   ACK         -->

   ACK (this is bad) -->

            <--      RESET
   ACK         -->

In the problem scenario above, the following events transpired. The client issues a Shutdown on their local socket after they sent the request to the server, notifying the socket that it will not be sending any more data. This causes a FIN packet to be sent very early in the conversation (this is perfectly legitimate programming style). Later, the server issues a FIN to indicate it is done sending data, and the client acknowledges the FIN packet. Due to the way that Delayed Acknowledgments worked, it was possible for another ACK to be sent to the server after the ACK for the FIN packet. If the server has already closed the socket it was communicating with the client on, this will generate a RESET packet to the client.

If the client was still reading data, the RESET packet will cause the client read of data to return in error with a WSAECONNRESET, indicating that the connection was reset.

RESOLUTION

To resolve this problem, install the fix mentioned below.

Obtain the fix mentioned below or wait for the next Windows NT Service Pack.

The fix was to modify TCPIP.SYS to not send an acknowledgment if an acknowledgment was already sent for a FIN packet.

STATUS

Microsoft has confirmed this to be a problem with Windows NT version 3.51. This problem was corrected in the latest U.S. Service Pack for Windows NT Workstation or Server version 3.51. For information on obtaining this update, query on the following word in the Microsoft Knowledge Base (without the spaces):

   S E R V P A C K

Additional query words: prodnt wsock32
Version : 3.51

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: May 5, 1997
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.