Yep. That's the session timeout count down on the firewall.
Sent from my Galaxy Nexus
On Wed, Sep 18, 2013 at 06:54:14AM +0800, Colin Coe wrote:
> OK, I'm confused. Why don't I see the keep alives in the wireshark dump?
> I'm happy to upload my pcap file to dropbox.redhat.com for analysis
> Apologies for harping on about this but the users are getting annoyed with
> their sessions freezing or terminating. Also, we've confirmed that the
> exact timing is 30 minutes not 15 minutes
> I had a fairly long and productive chat with one of the guys that manage
> the other firewall cluster. I gave him the src and dst addresses and dst
> port and he was able to advise on the session state on the firewall. If I
> opened a spice session to a RHEL server (no X) and minimised it, all 4
> sessions on the 'odd' port started counting down from 1800.
What is that counter? Is it the firewall keeping track of keep alive
packets, and dropping the connection when this second-based counter drops