On Thu, 04 Jun 2020 13:55:26 +0100, Adrian wrote:

> strace on the target was started first.
>
>  From the source :
>
> strace: Process 14192 attached 10:37:20.669664 _newselect(7, [3 4], [],
> NULL, NULL) = 1 (in [3]) 10:52:56.729985 clock_gettime(CLOCK_BOOTTIME,
> {tv_sec=1368051, tv_nsec=670518415}) = 0 10:52:56.730243 read(3,
> 0x7ee59f44, 8192) = -1 ETIMEDOUT (Connection timed out)
> 10:52:56.730478 rt_sigaction(SIGWINCH, NULL, {sa_handler=0x1f200,
> sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x76b496b0}, 8) = 0
> 10:52:56.730684 rt_sigaction(SIGWINCH, {sa_handler=SIG_DFL, sa_mask=[],
> sa_flags=SA_RESTORER, sa_restorer=0x76b496b0}, NULL, 8) = 0
> 10:52:56.730900 getpid()                = 14192 10:52:56.731099 write(3,
>
"\0i\201\205\372Zs\335\20\200\344\252'E8(\346\321\241\2155\341\274\235\37
> 1S\230je\25\222U"..., 56) = -1 EPIPE (Broken pipe)
> 10:52:56.731323 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER,
> si_pid=14192, si_uid=0} ---
> 10:52:56.731464 write(2, "packet_write_wait: Connection to"..., 69) = 69
> 10:52:56.731706 exit_group(255)         = ?
> 10:52:56.733946 +++ exited with 255 +++
>
>  From the target :
> Process 27119 attached - interrupt to quit 10:36:56.750037 select(12, [3
> 5 9 11], [], NULL, NULL) = 1 (in [3]) 12:36:52.914438
> rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 12:36:52.915121
> rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 12:36:52.915631 read(3,
> 0xbe8f7054, 16384) = -1 ECONNRESET (Connection reset by peer)
> 12:36:52.916369 getuid32()              = 0 12:36:52.916998
> gettimeofday({1591274212, 917209}, NULL) = 0 12:36:52.917571 send(4,
> "Jun  4 12:36:52 sshd[27119]:"..., 85, MSG_NOSIGNAL) = 85
> 12:36:52.919113 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
> 12:36:52.919787 _llseek(7, 0, [0], SEEK_CUR) = 0 12:36:52.920301
> fstat64(7, {st_mode=S_IFREG|0644, st_size=1302, ...}) = 0
> 12:36:52.920963 mmap2(NULL, 1302, PROT_READ, MAP_SHARED, 7, 0) =
> 0xb6fee000 12:36:52.921599 _llseek(7, 1302, [1302], SEEK_SET) = 0
> 12:36:52.922215 munmap(0xb6fee000, 1302) = 0 12:36:52.922749 close(7)
>             = 0 12:36:52.923590 open("/etc/security/pam_env.conf",
> O_RDONLY|O_LARGEFILE) = 7 12:36:52.924284 fstat64(7,
> {st_mode=S_IFREG|0644, st_size=2980, ...}) = 0
> 12:36:52.924954 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6fee000 12:36:52.925473 read(7,
> "#\n# This is the configuration fi"..., 4096) = 2980 12:36:52.926186
> read(7, "", 4096)       = 0 12:36:52.926678 close(7)                = 0
> 12:36:52.927189 munmap(0xb6fee000, 4096) = 0 12:36:52.927764
> open("/etc/environment", O_RDONLY|O_LARGEFILE) = 7 12:36:52.928499
> fstat64(7, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 12:36:52.929185
> mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
> 0) = 0xb6fee000 12:36:52.929813 read(7, "", 4096)       = 0
> 12:36:52.930305 close(7)                = 0 12:36:52.930818
> munmap(0xb6fee000, 4096) = 0 12:36:52.931381
> open("/etc/security/pam_env.conf", O_RDONLY|O_LARGEFILE) = 7
> 12:36:52.932051 fstat64(7, {st_mode=S_IFREG|0644, st_size=2980, ...}) =
> 0
> 12:36:52.932713 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6fee000 12:36:52.933356 read(7,
> "#\n# This is the configuration fi"..., 4096) = 2980 12:36:52.934075
> read(7, "", 4096)       = 0 12:36:52.934572 close(7)                = 0
> 12:36:52.935085 munmap(0xb6fee000, 4096) = 0 12:36:52.935665
> open("/etc/default/locale", O_RDONLY|O_LARGEFILE) = 7 12:36:52.936250
> fstat64(7, {st_mode=S_IFREG|0644, st_size=52, ...}) = 0 12:36:52.936917
> mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
> 0) = 0xb6fee000 12:36:52.937544 read(7, "#  File generated by
> update-loca"..., 4096) = 52 12:36:52.938214 read(7, "", 4096)       = 0
> 12:36:52.938707 close(7)                = 0 12:36:52.939216
> munmap(0xb6fee000, 4096) = 0 12:36:52.940182 munmap(0xb693a000, 45200) =
> 0 12:36:52.940992 munmap(0xb6909000, 127468) = 0 12:36:52.941771
> munmap(0xb68ff000, 36904) = 0 12:36:52.942519 munmap(0xb68f5000, 36912)
> = 0 12:36:52.943399 munmap(0xb68eb000, 36952) = 0 12:36:52.944152
> munmap(0xb68e1000, 36972) = 0 12:36:52.944890 munmap(0xb68d6000, 41080)
> = 0 12:36:52.945764 munmap(0xb68c9000, 49360) = 0 12:36:52.946589
> exit_group(255)         = ?
> Process 27119 detached
>
It would be interesting to know what happened between  10:52:56 and
12:36:52 - assuming that the clocks on the two systems are synchronised.

I wonder if a wireshark journal would show anything useful. If the link
normally falls over as soon after it seems to have this time AND you
filter the stream to show just packets sent and received by the source
system, there shouldn't be too many unrelated packets to bypass.

Wireshark would be my tool of choice after I'd looked at the logs on both
ends of the link. These days it has a decent graphical interface. Anybody
who knows enough about networks to set up a hardwired LAN and configure
their hosts to talk to each other should find Wireshark fairly easy to
use.


--
Martin    | martin at
Gregorie  | gregorie dot org

--- SoupGate-Win32 v1.05