What does "connection reset by peer" mean?
What is the meaning of the «connection reset by peer» error on a TCP connection? Is it a fatal error or just a notification or related to the network failure?
3 Answers 3
It’s fatal. The remote server has sent you a RST packet, which indicates an immediate dropping of the connection, rather than the usual handshake. This bypasses the normal half-closed state transition. I like this description:
«Connection reset by peer» is the TCP/IP equivalent of slamming the phone back on the hook. It’s more polite than merely not replying, leaving one hanging. But it’s not the FIN-ACK expected of the truly polite TCP/IP converseur.
This means that a TCP RST was received and the connection is now closed. This occurs when a packet is sent from your end of the connection but the other end does not recognize the connection; it will send back a packet with the RST bit set in order to forcibly close the connection.
This can happen if the other side crashes and then comes back up or if it calls close() on the socket while there is data from you in transit, and is an indication to you that some of the data that you previously sent may not have been received.
It is up to you whether that is an error; if the information you were sending was only for the benefit of the remote client then it may not matter that any final data may have been lost. However you should close the socket and free up any other resources associated with the connection.
Docker совет №28: Как исправить ошибку 'Connection Reset by Peer'
Jun 14, 2018 07:04 · 172 words · 1 minute read docker
Вы наверняка видели эту ошибку, когда пытались подключиться к web-серверу, запущенному в docker-контейнере. К слову, отсутствие ответа от web-сервера — тоже довольно распространенная ошибка. Давайте разберемся!
В зависимости от того, какой инструмент вы используете ( curl , http , браузер) полученные ошибки могут отличаться, но результат будет тот же — ваш web-сервер не вернет вам ожидаемую страницу.
Возможно, вы даже попытались устранить эту ошибку: например, установили curl внутри docker-контейнера и запустили
(или любой другой порт, на котором работает web-сервер) — и все отработало как ожидалось.
Если так и произошло — с большой долей вероятности это связано с тем, что в настройках вашего web-сервера есть привязка к localhost, то есть, что он будет доступен только внутри вашего контейнера.
Для устранения данной проблемы разрешите своему web-серверу слушать на всех доступных сетевых интерфейсах (проще говоря, вместо localhost укажите 0.0.0.0). Практически всегда это то, что нужно сделать если вы хотите предоставить публичный доступ к вашему web-приложению.
Да, и конечно же, не забудьте о пробросе портов ( -p 3000:3000 ) при запуске вашего docker-контейнера, если к нему нужен доступ снаружи.
6 Ways to Fix Connection Reset by peer
Connection Reset by peer means the remote side is terminating the session. This error is generated when the OS receives notification of TCP Reset (RST) from the remote peer.
Understanding Connection Reset by peer
Connection reset by peer means the TCP stream was abnormally closed from the other end. A TCP RST was received and the connection is now closed. This occurs when a packet is sent from our end of the connection but the other end does not recognize the connection; it will send back a packet with the RST bit set in order to forcibly close the connection.
“Connection reset by peer” is the TCP/IP equivalent of slamming the phone back on the hook. It’s more polite than merely not replying, leaving one hanging. But it’s not the FIN-ACK expected of the truly polite TCP/IP.
Understanding RST TCP Flag
RST is used to abort connections. It is very useful to troubleshoot a network connection problem.
RST (Reset the connection). Indicates that the connection is being aborted. For active connections, a node sends a TCP segment with the RST flag in response to a TCP segment received on the connection that is incorrect, causing the connection to fail.
The sending of an RST segment for an active connection forcibly terminates the connection, causing data stored in send and receive buffers or in transit to be lost. For TCP connections being established, a node sends an RST segment in response to a connection establishment request to deny the connection attempt. The sender will get Connection Reset by peer error.
Check network connectivity
The “ping” command is a tool used to test the availability of a network resource. The “ping” command sends a series of packets to a network resource and then measures the amount of time it takes for the packets to return.
If you want to ping a remote server, you can use the following command: ping <remote server>
In this example, “<remote server>” is the IP address or hostname of the remote server that you want to ping.
Ping the remote host we were connected to. If it doesn’t respond, it might be offline or there might be a network problem along the way. If it does respond, this problem might have been a transient one (so we can reconnect now)
If you are experiencing packet loss when pinging a remote server, there are a few things that you can do to troubleshoot the issue.
The first thing that you can do is check the network interface on the remote server. To do this, use the “ifconfig” command. The output of the “ifconfig” command will show you the status of all network interfaces on the system. If there is a problem with one of the interfaces, it will be shown in the output.
You can also use the “ip route” command to check routing information. The output of the “ip route” command will show you a list of all routes on the system. If there is a problem with one of the routes, it will be shown in the output.
If you are still experiencing packet loss, you can try to use a different network interface. To do this, use the “ping” command with the “-i” option. For example, the following command will use the eth0 interface:
ping -i eth0 google.com
Check remote service port is open
A port is a logical entity which acts as a endpoint of communication associated with an application or process on an Linux operating system. We can use some Linux commands to check remote port status.
Commands like nc, curl can be used to check if remote ports are open or not. For example, the following command will check if port 80 is open on google.com:
nc -zv google.com 80
The output of the above command should look something like this: Connection to google.com port 80 [tcp/80] succeeded!
This means that the port is open and we can establish a connection to it.
Check application log on remote server
For example, if the error is related with SSH. we can debug this on the remote server from sshd logs. The log entries will be in one of the files in the /var/log directory. SSHD will be logging something every time it drops our session.
Oct 22 12:09:10 server internal-sftp[4929]: session closed for local user fred from [192.0.2.33]
Check related Linux kernel parameters
Kernel parameter is also related to Connection Reset by peer error. The keepalive concept is very simple: when we set up a TCP connection, we associate a set of timers. Some of these timers deal with the keepalive procedure. When the keepalive timer reaches zero, we send our peer a keepalive probe packet with no data in it and the ACK flag turned on.
we can do this because of the TCP/IP specifications, as a sort of duplicate ACK, and the remote endpoint will have no arguments, as TCP is a stream-oriented protocol. On the other hand, we will receive a reply from the remote host (which doesn’t need to support keepalive at all, just TCP/IP), with no data and the ACK set.
If we receive a reply to we keepalive probe, we can assert that the connection is still up and running without worrying about the user-level implementation. In fact, TCP permits us to handle a stream, not packets, and so a zero-length data packet is not dangerous for the user program.
we usually use tcp keepalive for two tasks:
- Checking for dead peers
- Preventing disconnection due to network inactivity
Check Application heartbeat configuration
Connection Reset by peer error is also related to the application. Certain networking tools (HAproxy, AWS ELB) and equipment (hardware load balancers) may terminate “idle” TCP connections when there is no activity on them for a certain period of time. Most of the time it is not desirable.
We will use rabbitmq as an example. When heartbeats are enabled on a connection, it results in periodic light network traffic. Therefore heartbeats have a side effect of guarding client connections that can go idle for periods of time against premature closure by proxies and load balancers.
With a heartbeat timeout of 30 seconds the connection will produce periodic network traffic roughly every 15 seconds. Activity in the 5 to 15 second range is enough to satisfy the defaults of most popular proxies and load balancers. Also see the section on low timeouts and false positives above.
Check OS metric on peer side
Connection Reset by peer can be triggered by a busy system. we can setup a monitoring for our Linux system to the metrics like CPU, memory, network etc. If the system is too busy, the network will be impacted by this.
For example, we can use the “top” command to check the CPU usage. The output of the “top” command will show us the list of processes sorted by CPU usage. If there is a process which is using a lot of CPU, we can investigate this further to see if it is causing the network issues.
We can also use the “netstat” command to check network statistics. The output of the “netstat” command will show us a list of active network connections. If there are too many connections established, this could be causing the network issues.
We can use these commands to troubleshoot network issues on a Linux system. By using these commands, we can narrow down the root cause of the issue and fix it.
How To Fix the Error “Connection Reset by Peer”
Have you gotten error messages like “Connection reset by peer” or “Socket write error?” Maybe you’re curious about what causes them and what they mean.
This article will explain these error messages and why we receive them.
What Does it Mean?
A “connection reset by peer” error means the TCP stream was closed, for whatever reason, from the other end of the connection. In other words, the TCP RST was sent and received, but the connection is closed.
This issue may happen when you send a packet on your end of the connection, but the other end doesn’t recognize the connection. It’ll send back a packet with an RST bit to close the connection.
The error can happen when the peer crashes. Other times, it’s due to poorly-written applications that don’t shut their TCP connections properly.
A possible solution to this is editing the hosts.deny file. Type or paste this line for those using nano on a Debian-based system.
sudo nano /etc/hosts.deny
Look for your local IP address or host name in the file.
- Log in to your remote server.
- After accessing the file and clearing the IP or hostnames, save and exit.
- Try to reconnect using SSH.
- Type this line as a precaution:
sudo nano /etc/hosts.allow
- Open this file and add your hostname and IP address.
- Save and exit the file.
- Try to establish an SSH connection again.
It’s essential to remember that once you enable these settings, you restrict the ability to maintain or control remote servers. Only proceed after understanding the risks.
Modify Fail2ban
Fail2ban protects users from brute-force attacks, and attempting to connect multiple times may fool the software into thinking you’re an attacker. As a result, you need to configure the file and add the IP or IP ranges to the white list.
- Access your remote server.
- Enter “sudo nano /etc/fail2ban/jail.conf”.
- Once you’re in the file, add the IP address or range to the “ignoreip =+ line”.
- Save and exit.
From then on, Fail2ban will let you through.
Check sshd_config
If the error persists, the problem may lie in the sshd_config file. Try these steps to resolve the issue.
- Enter “tail -f /var/log/auth.log” to read the latest log entries.
- Once you find clues, type and execute “sudo nano /etc/ssh/sshd_config”.
- Edit the file so your system can accept more connections.
- Save the file.
- Restart the sshd service.
Unless you’re familiar with the variable, try not to edit it. It may result in an unreachable server. Should none of these solutions work, contact your host for assistance.
Connection Reset by Peer with a Socket Write Error
Sometimes you could have issues connecting to a remote computer, and you’ll receive the “Connection reset by peer socket write error.” Several possible causes exist, such as abruptly terminated connections, the socket receiving a command to close, and more.
The first order of business is finding out whether your server is reachable.
- Open the Command Prompt.
- Type “ping” along with the server’s address. Execute the command.
- Run “tracert” and the server address to see if the request is successful.
- Execute “telnet” and enter the server address to see if the local machine ports are open.
- Should the connection fail, you must run SDEINTERCEPT and diagnose the problem.
Occasionally, this error comes with “SocketException.” It occurs when data is written or read to or from a closed socket connection. Below are some possible root causes.
- Firewalls closing the socket connections
- A slow network connection
- Lengthy idle connection
- Application errors
A slow connection may be alleviated by setting a higher socket timeout period. That will prevent any sockets from closing before connections are possible.
As for firewalls, you can either turn them off or configure them to prevent a SocketException.
The best solution for idle connections is sending heartbeat messages. These are periodic and prevent server idling, which makes the server stop and save resources.
One of the best solutions to a SocketException is to surround or throw it with a try-catch block. Close the connection to the server and start a new one. You may resolve the error this way.
Strangely, Adobe claims you can ignore the error.
Connection Reset by Peer with a cURL Command
A cURL error 56 is sometimes encountered by clients when trying to connect to the server. It’s usually because the server fails to receive any incoming network information. The following are more precise causes:
- Idle server connections
- URL whitespace
- Restrictions in the firewall
A server upgrade, cURL update, and firewall configuration usually fix the idling server issue. It’s also helpful to set the Maximum Transmission Unit to 1500 bytes, the default value.
A problematic URL is enough to trigger cURL 56 errors too. Simply updating the repository should restore the server’s functionality.
Whitespace is also easily removed. The command to do that does remove the whitespace without distinction. However, if the URL does have intentional whitespace, it should be left alone.
Contact your host for assistance if none of these solutions are helping.
Additional FAQs
What is a SocketException?
A SocketException is when a socket error occurs. Both Socket and Dns classes throw this error when the network isn’t configured correctly.
Why are sockets closed?
Should your server sockets be closed, it may be due to a terminated connection, but there isn’t a specific provided reason. The Driver isn’t aware or sure of what happened to the connection.
What is a cURL error?
There are many cURL errors, but they often result from outdated PHP or cURL versions. They don’t have anything to do with SSLs but are a problem with the server. You usually won’t notice anything on your website’s front end.
Back to Normal
Connection reset by peer errors come in various forms, and it’s impossible to cover them all in one article. However, some of the solutions above tend to help address commonly-encountered problems. If all else fails, it’s best to consult a professional or host.
Which of these errors have you run into? Do you know of other solutions? Let us know in the comments section below.