Does anybody have an idea on why a socket which had already been connected and tranceiving data was reset by kernel?
10.103.143.101 was downloading data from network.
Check the tcpdump bellow. Thanks!
26110 14:58:44.369708 122.11.56.106 10.103.143.101 HTTP Continuation or non-HTTP traffic
26112 14:58:44.371356 122.11.56.106 10.103.143.101 HTTP Continuation or non-HTTP traffic
26113 14:58:44.372088 10.103.143.101 122.11.56.106 TCP 42421 > 80 [ACK] Seq=1 Ack=9062171 Win=36787 Len=0 TSV=253488 TSER=1943531727
26115 14:58:44.373919 10.103.143.101 122.11.56.106 TCP 42421 > 80 **[RST, ACK]** Seq=1 Ack=9062171 Win=36864 Len=0 TSV=253488 TSER=1943531727
This could be a myriad of things and it is impossible to tell from just that trace. A few possibilities include the remote host could have been shutdown, the program on the host could have been shut down, a proxy could have shut it down, etc.
Do you have access to the remote host? If you do perhaps you can view some log files from the application on that end? Hope that helps.