Explaining Connection Reset by Peer Log Messages

Tim Potter

Revision History
Revision 0.12006-01-17
Initial version.

Abstract

The message "Connection reset by peer" appears frequently through the log files generated by Samba and questions about it often appear on the Samba mailing list. We offer an explanation for this phenomenon.


CIFS Client Connections

Messages like the following often appear in Samba's log files:

[2004/12/01 02:41:22, 0] lib/util_sock.c:read_socket_data(384)
  read_socket_data: recv failure for 4. Error = Connection reset by peer

The technical explanation for this error is that Samba has tried to read (or write) from a TCP socket but that socket has been closed by the client at the other end with no notification given to Samba. Normally, as part of gracefully closing down a TCP connection, both the client and the server exchange TCP packets and agree to close both ends of their pipe. No error messages are produced in Samba's log files in this case. If something unexpected occurs at the remote end, such as the client being reset or the remote application crashing, then any open TCP connections may not be closed down properly. A condition like this may produce the connection reset by peer message in the log.

A more likely explanation, however, involves the behaviour of modern (Windows 2000 and above) clients when setting up a connection to a Samba server. SMB/CIFS operates on two TCP ports, port 139 and port 445. In the interests of minimising waiting time, Windows opens two connections simultaneously. One to port 139 and another to port 445. When it receives a response to one of these connection requests, the other one is discarded. When Samba tries to read a packet from the discarded connection, it receives the connection reset by peer error, and this is dutifully logged.

Samba could probably cope with this situation more gracefully, and not produce an error which resembles some kind of problem, but in reality is just part of the normal operation of the network.