We have a system built with Apache CXF 2.5.x that uses SOAP messages with MTOM attachments in the responses.
Every so often, a client encounters an exception complaining that the socket has been closed that CXF is reading while reading the HTTP response with one of these attachments.
The server shows nothing interesting happening.
We wonder: how can we tell if the socket is closed because the server side shut it down violently as opposed to some rogue code in the client calling close() on it?
You can start with WireShark. It will show all the traffic in the network. From there you can see which side sends a FIN or RST for the socket.
Use a filter when capturing, e.g. if running on the client side, filter by the IP address of the server. From the command line: