Normally on a TCP/IP peer-peer connection, a connection is terminated by one side sending a FIN packet. This is reported to the other side by a return from a blocking call to recv() indicating zero bytes received (EOF).

Our application is running on RedHat 7.4 and establishes permanent TCP/IP connections to another system. During normal traffic flow, it will occasionally disconnect from the peer for no apparent reason. Investigation showed that the blocking call to recv() returns zero bytes (EOF) which causes the code to shutdown and close the socket. However, Wireshark traces confirm that the peer did NOT send a FIN or RST to end the session.

Under what other conditions can the kernel TCP/IP stack return zero bytes from a recv() call during a normal, stable session?

Could it be that an RST is sent by an intermediate router? Due to NAT/firewall idle TCP timeout?

Thanks for your response.

Wireshark traces at the interface of the client system show no FIN or RST coming from the other side. What we see is this (10.59.150.179 is our client system):

No. Time Source Destination Protocol Length Info
48883 2024-05-05 09:35:58.457479 10.59.150.179 10.15.50.27 TCP 347 53450 → 4803 [PSH, ACK] Seq=574894 Ack=381957 Win=63270 Len=293
48884 2024-05-05 09:35:58.466093 10.15.50.27 10.59.150.179 TCP 60 4803 → 53450 [ACK] Seq=381957 Ack=575187 Win=14946 Len=0
48888 2024-05-05 09:35:58.487998 10.59.150.179 10.15.50.27 TCP 369 53450 → 4803 [PSH, ACK] Seq=575187 Ack=381957 Win=63270 Len=315
48889 2024-05-05 09:35:58.496546 10.15.50.27 10.59.150.179 TCP 60 4803 → 53450 [ACK] Seq=381957 Ack=575502 Win=14631 Len=0
48899 2024-05-05 09:35:58.533152 10.59.150.179 10.15.50.27 TCP 711 53450 → 4803 [PSH, ACK] Seq=575502 Ack=381957 Win=63270 Len=657
48902 2024-05-05 09:35:58.541768 10.15.50.27 10.59.150.179 TCP 60 4803 → 53450 [ACK] Seq=381957 Ack=576159 Win=13974 Len=0
48972 2024-05-05 09:35:58.811536 10.15.50.27 10.59.150.179 TCP 712 4803 → 53450 [PSH, ACK] Seq=381957 Ack=576159 Win=15876 Len=658
48973 2024-05-05 09:35:58.811557 10.59.150.179 10.15.50.27 TCP 54 53450 → 4803 [ACK] Seq=576159 Ack=382615 Win=63270 Len=0
<At this point our client application's socket get a zero byte return from a recv() call, which causes it to close the connection>
48974 2024-05-05 09:35:58.815989 10.59.150.179 10.15.50.27 TCP 54 53450 → 4803 [FIN, ACK] Seq=576159 Ack=382615 Win=63270 Len=0
48975 2024-05-05 09:35:58.816003 10.59.150.179 10.15.50.27 TCP 54 53450 → 4803 [RST, ACK] Seq=576160 Ack=382615 Win=63270 Len=0

Why would the tcpip stack do this without any FIN or RST from the other side?

> At this point our client application's socket get a zero byte return from a recv() call, which causes it to close the connection
Your client might send out too short TCP packet.