Following my troubleshooting of making a TLS connection (See: Testing TLS with openssl), it looks like there might be an active firewall in place.

1. The connection on that port works with nc on both sides (nc -l -p 8883 on the server, nc server.com 8883 on the client)

2. It even works if I manually send the binary preamble for making a TLS connection, but leave off the last byte (again, captured with nc -l -p 8883 | xxd). I think I see a delay…

3. Just incase I also checked if the connection is just being forced closed at 289 bytes, so I sent a lot of random text and it went through fine.

4. Sending the full TLS preamble results in nothing received at the server, and the connection closed. I tried adding some delay before the last byte, it goes through and the connection stays open!

What the heck is this and how do I phrase my request to the company IT to allow it? (we have a special APN set up with AT&T and I think that’s where it is)

Trouble shooting details:

I used nc -l -p 8883 to capture the TLS preamble from a successful connection attempt to the server from elsewhere (289 bytes)

0000000: 1603 0101 1c01 0001 1803 03f4 f363 0180  
0000010: 3ce4 957f ee17 8b7f d8ef 9ce0 e608 1cac  
0000020: d328 798d 8b10 cc7b b521 0....
...
0000120: 01

Then here’s the client command to reproduce it:

(head TLS1.hex -n18 | xxd -r; sleep 0.3; echo 0: 01 | xxd -r ) 
                                  | nc server.com 8883 -q 1 

• < 0.3s, fails
• = 0.3s fails intermittently
• > 0.3s, succeeds

Continue reading Socket closed depending on data. Am I facing an active firewall? (DPI – Deep Packet Inspection)→