This section is about the basic setup of any optimized TCP session.
These messages are logged at INFO level, which means that they are normally not visible in the logs.
This is the setup of a TCP session between the client and the server on TCP port 25. The default values are used at the in-path rules, nothing fancy. Despite this is the first example, assumed is that the Out-of-Band Splice has already been setup.
Figure 9.3. Setup of an optimized TCP session from the client-side Steelhead appliance, Enhanced Auto Discovery and no Enhanced Auto Discovery
CSH sport[24798]: [splice/client.INFO] 2 {10.0.1.1:60832 192.168.1.1:25} init client 10.0. \ 1.1:60832 server 192.168.1.1:25 cfe 10.0.1.6:7801 sfe 192.168.1.6:7800 client connecte \ d: yes CSH sport[24798]: [splice/client.INFO] 2 {10.0.1.1:60832 192.168.1.1:25} Splice client sid \ e initializing: No protocol port = 25 protocol id = TCP(0) transport = TRANSPORT_ID_NO \ NE CSH sport[24798]: [splice/client.INFO] 2 {10.0.1.1:60832 192.168.1.1:25} Start flowing, lp \ ort 40268, rport 7800, OPOL_NORMAL, NAGLE_ALWAYS, PREOPT_NONE, LATOPT_AUTO, TRANSPORT_ \ ID_NONE, TPTOPT_NONE(0x0) CSH sport[24798]: [splice/client.INFO] 2 {10.0.1.1:60832 192.168.1.1:25} fini client 10.0. \ 1.1:60832 server 192.168.1.1:25 cfe 10.0.1.6:40268 sfe 192.168.1.6:7800 app TCP
The client-side of the optimized TCP session can be determined by the logging facility: splice/client. The first line is printed when the SYN/ACK+ has been returned from the server-side Steelhead appliance.
There are four lines logged:
The first line is the start of the optimized TCP session, init. It determines the IP addresses and TCP ports of the client, the server, the client-side Steelhead appliance cfe and the server-side Steelhead appliance sfe. The TCP port of the client-side Steelhead appliance is port 7801, which is an internal port.
The words client connected: yes shows that the OOB Splice has already been setup.
The second line determines the latency optimization, plain TCP in this case protocol id = TCP(0), and the pre-optimization parameters.
TRANSPORT_ID_NONE: Nothing special on the inner channel.
TRANSPORT_ID_SSLINNER: The inner channel is SSL encrypted.
The third line shows the TCP ports of the inner channel and the parameters on the outer channels.
The words lport 40268 are from the TCP port of the inner channel on the client-side Steelhead appliance, the words rport 7800 are from the TCP port of the inner channel on the server-side Steelhead appliance.
The next fields are the Optimization Policy, the Neural Framing, the Pre-optimization Policy, the Latency Policy, the inner channel Transport layer Policies and the Transport Optimization.
Optimization Policy:
OPOL_NORMAL: Perform full optimization with SDR and compression.
OPOL_SDR_ONLY: Perform SDR Only, do not perform compression.
OPOL_COMPR_ONLY: Perform only compression, do not perform SDR.
OPOL_NONE: Do not perform SDR nor compression.
OPOL_IN_MEM_ONLY: Use SDR-M: Perform full optimization with SDR and compression but keep the references in memory only, do not write them to disk.
Neural Framing Mode:
NAGLE_NEVER: Always process the TCP payload packet by packet.
NAGLE_ALWAYS: Use the Nagle algorithm to decide when to process the TCP payload data.
NAGLE_TCPHINTS: Process the TCP payload data when a TCP packet with the PUSH flag has arrived.
NAGLE_NEURAL: Let the neural framing algorithm decide when to process the TCP payload data.
The Pre-optimization Policy:
PREOPT_NONE: No pre-optimization necessary.
PREOPT_SSL: The data on the outer channels is SSL encrypted.
PREOPT_JINIT: The data on the outer channels is jinitiator encapsulated.
PREOPT_JINIT_SSL: The data on the outer channels is jinitiator over SSL encrypted.
The Latency Optimization Policy:
LATOPT_AUTO: The Latency Optimization is determined on the destination TCP port.
LATOPT_HTTP: Use HTTP Latency Optimization.
LATOPT_NONE: Do not use any Latency Optimization.
LATOPT_RPCH: Use RPC-over-HTTP Latency for Outlook Anywhere.
The inner channel Transport layer Policies:
TRANSPORT_ID_NONE: No transport policy, the inner channel is not encrypted.
TRANSPORT_ID_SSLINNER: The inner channel is SSL encrypted.
Transport Optimization:
TPTOPT_NONE: Do not perform a transport optimization.
SCPS_IN_TE_W: Act as a SCPS initiator terminator on the WAN side.
SCPS_IN_TE_L: Act as a SCPS initiator terminator on the LAN side.
SCPS_TE_W: Act as a SCPS terminator on the WAN side.
SCPS_TE_L: Act as a SCPS terminator on the LAN side.
SCPS_IN_W: Act as a SCPS initiator on the WAN side.
SCPS_IN_L: Act as a SCPS initiator on the LAN side.
TPTOPT_PROXY: Do not use SCPS, only act as a TCP proxy.
The fourth line is the termination of the optimized TCP session, fin. It shows the IP addresses and TCP ports of the client, server, client-side Steelhead appliance and the server-side Steelhead appliance.
With Enhanced Auto Discovery the TCP session towards the server is setup before the inner channel is created.
Figure 9.4. Setup of an optimized TCP session from the server-side Steelhead appliance, Enhanced Auto Discovery
SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:0 clnt: 10.0.1.1:60832 se \ rv: 192.168.1.1:25) init SSH sport[24255]: [splice/server.INFO] 2 {- -} init cfe 10.0.1.6:40268 sfe 192.168.1.6:780 \ 0 SSH sport[24255]: [splice/server.INFO] 2 {- -} sock 40 id 548627 client 10.0.1.1:60832 se \ rver 192.168.1.1:25 remote inner port 7800 trpy TRPY_NONE SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:40269 clnt: 10.0.1.1:6083 \ 2 serv: 192.168.1.1:25) acquired SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:40269 clnt: 10.0.1.1:6083 \ 2 serv: 192.168.1.1:25) fini SSH sport[24255]: [splice/server.INFO] 2 {- -} Splice server side initializing: No protoco \ l port = 25 transport = TRANSPORT_ID_NONE SSH sport[24255]: [splice/server.INFO] 2 {10.0.1.1:60832 192.168.1.1:25} Start flowing, lp \ ort 7800, rport 40268, OPOL_NORMAL, NAGLE_ALWAYS, PREOPT_NONE, LATOPT_AUTO, TRANSPORT_ \ ID_NONE, TPTOPT_NONE(0x0) SSH sport[24255]: [splice/server.INFO] 2 {10.0.1.1:60832 192.168.1.1:25} fini client 10.0. \ 1.1:60832 server 192.168.1.1:25 cfe 10.0.1.6:40268 sfe 192.168.1.6:7800 app TCP
The server-side of the optimized TCP session can be determined by the logging facility: splice/probe and splice/server. The first line is printed when a SYN+ packet is seen.
The first line identifies the auto discovery probe in the SYN+ packet: It determines the in-path interface IP address the probe came in on and the IP addresses and TCP ports of the client and server. Note that this line was not shown on the client-side Steelhead appliance.
The second line is printed when the TCP session with the server has been setup. It contains the IP addresses and TCP port numbers of the inner channel to be setup.
The third line contains the IP addresses and TCP port numbers of the client and the server and the WAN visibility mode:
WAN Visibility:
TRPY_NONE: Correct Addressing
TRPY_PORT: Port Transparency
TRPY_FULL: Full Transparency
Line four and five are internal housekeeping of the auto-discovery phase.
Line six contains the protocol port and the Transport Policies.
Line seven shows the TCP ports of the inner channel and the parameters on the outer channels.
The lport is the TCP port of the inner channel on the client-side Steelhead appliance.
The rport is the TCP port of the inner channel on the server-side Steelhead appliance.
The next fields are the Optimization Policy, the Neural Framing, the Pre-optimization Policy, the Latency Policy, the Transport layer Policies and the Transport Optimization.
Line eight shows the end of the optimized TCP session again.
Without Enhanced Auto Discovery the inner channel is created before the TCP session towards the server is setup. The logging on the client-side Steelhead appliance is the same as with Enhanced Auto Discovery enabled.
Figure 9.5. Setup of an optimized TCP session from the server-side Steelhead appliance, No Enhanced Auto Discovery
SSH sport[3073]: [splice/server.INFO] 2 {- -} init cfe 10.0.1.6:40268 sfe 192.168.1.6:7800 \ SSH sport[3073]: [splice/server.INFO] 2 {- -} sock 39 id 548627 client 10.0.1.1:52776 ser \ ver 192.168.1.1:25 remote inner port 7800 trpy TRPY_NONE SSH sport[3073]: [splice/server.INFO] 2 {- -} Splice server side initializing: No protocol \ port = 25 transport = TRANSPORT_ID_NONE SSH sport[3073]: [splice/server.INFO] 2 {10.0.1.1:52776 192.168.1.1:25} Start flowing, lpo \ rt 7800, rport 40268, OPOL_NORMAL, NAGLE_ALWAYS, PREOPT_NONE, LATOPT_AUTO, TRANSPORT_I \ D_NONE, TPTOPT_NONE(0x0) SSH sport[3073]: [splice/server.INFO] 2 {10.0.1.1:52776 192.168.1.1:25} fini client 10.0.1 \ .1:52776 server 192.168.1.1:25 cfe 10.0.1.6:40268 sfe 192.168.1.6:7800 app TCP
As can be seen here, the splice/probe messages do not appear because without Enhanced Auto Discovery the inner channel is setup towards the first Steelhead appliance in the network and therefore no further detection is necessary performed.
When two Steelhead appliances setup an optimized TCP session between two in-path interfaces for the first time, they will setup the Out-of-Band Splice first and then the optimized TCP session. Note that the setup of the TCP sessions for the Connection Pool is not logged in the system logs.
Figure 9.6. Setup of an OOB Splice from the client-side Steelhead appliance, Enhanced Auto Discovery
CSH sport[24798]: [splice/client.INFO] 1 {10.0.1.1:47616 192.168.1.1:25} init client 10.0. \ 1.1:47616 server 192.168.1.1:25 cfe 10.0.1.6:7801 sfe 192.168.1.6:7800 client connecte \ d: no CSH sport[24798]: [splice/oob.INFO] 1 {- -} New OOB Splice created at 10.0.1.6 for peer 19 \ 2.168.1.6 CSH sport[24798]: [mgmt.INFO] - {- -} mgmtd notified that remote peer 192.168.1.6 was disc \ overed CSH sport[24798]: [splice/oob.INFO] 1 {- -} Establishing OOB Splice from 10.0.1.6:0 to 192 \ .168.1.6:7800 CSH mgmtd[3766]: [mgmtd.INFO]: EVENT: /rbt/sport/peer/event/added CSH sport[24798]: [splice/oob.INFO] 1 {- -} OOB Splice connected from 10.0.1.6:40271 to 19 \ 2.168.1.6:7800 CSH sport[24798]: [splice/oob.INFO] 1 {- -} Negotiated sport protocol version: 8 for peer: \ 192.168.1.6:7800 CSH sport[24798]: [splice/client.INFO] 1 {10.0.1.1:47616 192.168.1.1:25} Splice client sid \ e initializing: No protocol port = 25 protocol id = TCP(0) transport = TRANSPORT_ID_NO \ NE CSH sport[24798]: [splice/client.INFO] 1 {10.0.1.1:47616 192.168.1.1:25} Start flowing, lp \ ort 40269, rport 7800, OPOL_NORMAL, NAGLE_ALWAYS, PREOPT_NONE, LATOPT_AUTO, TRANSPORT_ \ ID_NONE, TPTOPT_NONE(0x0) CSH sport[24798]: [splice/client.INFO] 1 {10.0.1.1:47616 192.168.1.1:25} fini client 10.0. \ 1.1:47616 server 192.168.1.1:25 cfe 10.0.1.6:40269 sfe 192.168.1.6:7800 app TCP
Line one has the words client connected: no, which means that no OOB Splice has been setup yet.
Line two to seven are related to the setup of the OOB Splice.
Line eight and nine are the setup of the inner channel of the optimized TCP session.
Figure 9.7. Setup of an OOB Splice from the server-side Steelhead appliance, Enhanced Auto Discovery
SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:0 clnt: 10.0.1.1:47616 se \ rv: 192.168.1.1:25) init SSH sport[24255]: [splice/oob.INFO] 1 {- -} New OOB Splice created at 192.168.1.6 for peer \ 10.0.1.6 SSH sport[24255]: [mgmt.INFO] - {- -} mgmtd notified that remote peer 10.0.1.6 was discove \ red SSH sport[24255]: [splice/oob.INFO] 1 {- -} Negotiated sport protocol version: 8 for peer: \ 10.0.1.6:0 SSH mgmtd[4018]: [mgmtd.INFO]: EVENT: /rbt/sport/peer/event/added SSH sport[24255]: [splice/server.INFO] 1 {- -} init cfe 10.0.1.6:40269 sfe 192.168.1.6:780 \ 0 SSH sport[24255]: [splice/server.INFO] 1 {- -} sock 41 id 548627 client 10.0.1.1:47616 se \ rver 192.168.1.1:25 remote inner port 7800 trpy TRPY_NONE SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:40268 clnt: 10.0.1.1:4761 \ 6 serv: 192.168.1.1:25) acquired SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:40268 clnt: 10.0.1.1:4761 \ 6 serv: 192.168.1.1:25) fini SSH sport[24255]: [splice/server.INFO] 1 {- -} Splice server side initializing: No protoco \ l port = 25 transport = TRANSPORT_ID_NONE SSH sport[24255]: [splice/server.INFO] 1 {10.0.1.1:47616 192.168.1.1:25} Start flowing, lp \ ort 7800, rport 40269, OPOL_NORMAL, NAGLE_ALWAYS, PREOPT_NONE, LATOPT_AUTO, TRANSPORT_ \ ID_NONE, TPTOPT_NONE(0x0) SSH sport[24255]: [splice/server.INFO] 1 {10.0.1.1:47616 192.168.1.1:25} fini client 10.0. \ 1.1:47616 server 192.168.1.1:25 cfe 10.0.1.6:40269 sfe 192.168.1.6:7800 app TCP
Line two to five are for the setup of the inner channel.
On the server-side Steelhead appliance the logging is similar to the server-side Steelhead appliance with Enhanced Auto Discovery enabled, but without the splice/probe messages:
Figure 9.8. Setup of an OOB Splice from the server-side Steelhead appliance, no Enhanced Auto Discovery
SSH sport[3073]: [splice/oob.INFO] 1 {- -} New OOB Splice created at 192.168.1.6 for peer \ 10.0.1.6 SSH sport[3073]: [mgmt.INFO] - {- -} mgmtd notified that remote peer 10.0.1.6 was discover \ ed SSH sport[3073]: [splice/oob.INFO] 1 {- -} Negotiated sport protocol version: 8 for peer: \ 10.0.1.6:0 SSH mgmtd[4018]: [mgmtd.INFO]: EVENT: /rbt/sport/peer/event/added SSH sport[3073]: [splice/server.INFO] 1 {- -} init cfe 10.0.1.6:40269 sfe 192.168.1.6:7800 \ SSH sport[3073]: [splice/server.INFO] 1 {- -} sock 40 id 548627 client 10.0.1.1:34669 ser \ ver 192.168.1.1:25 remote inner port 7800 trpy TRPY_NONE SSH sport[3073]: [splice/server.INFO] 1 {- -} Splice server side initializing: No protocol \ port = 25 transport = TRANSPORT_ID_NONE SSH sport[3073]: [splice/server.INFO] 1 {10.0.1.1:34669 192.168.1.1:25} Start flowing, lpo \ rt 7800, rport 40269, OPOL_NORMAL, NAGLE_ALWAYS, PREOPT_NONE, LATOPT_AUTO, TRANSPORT_I \ D_NONE, TPTOPT_NONE(0x0) SSH sport[3073]: [splice/server.INFO] 1 {10.0.1.1:34669 192.168.1.1:25} fini client 10.0.1 \ .1:34669 server 192.168.1.1:25 cfe 10.0.1.6:40269 sfe 192.168.1.6:7800 app TCP
Before the inner channel of an optimized TCP session can be setup, the Out-of-Band Splice must have been setup. If the OOB Splice cannot be setup, then the optimized TCP session will not be setup.
Figure 9.9. Cannot setup OOB Splice
CSH sport[4564]: [splice/client.INFO] 1 {10.0.1.1:56604 192.168.1.1:25} init client 10.0.1 \ .1:56604 server 192.168.1.1:25 cfe 10.0.1.6:7801 sfe 192.168.1.6:7800 client connected \ : no CSH sport[4564]: [splice/client.INFO] 1 {10.0.1.1:56604 192.168.1.1:25} fini client 10.0.1 \ .1:56604 server 192.168.1.1:25 cfe 10.0.1.6:0 sfe 192.168.1.6:7800 app TCP CSH kernel: [intercept.INFO] Peer 192.168.1.6:7800 is unreachable or incompatible. New con \ nections going through that peer will be passed through temporarily. CSH kernel: [intercept.INFO] Peer 192.168.1.6:7800 is unreachable or incompatible. New con \ nections going to server 192.168.1.1:25 through that peer using local inpath 10.0.1.6 \ will be passed through for at least 293 seconds. CSH sport[4564]: [connect_pool.WARN] - {- -} Error connecting to peer: Connection timed ou \ t
With Enhanced Auto Discovery the outer channel towards the server is setup before the inner channel is established. Therefore this issue is only logged on the server-side Steelhead appliance:
Figure 9.10. Server-side Steelhead appliance, no service listening on TCP port 25, Enhanced Auto Discovery
SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:0 clnt: 10.0.1.1:22778 se \ rv: 192.168.1.1:25) init SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:40427 clnt: 10.0.1.1:2277 \ 8 serv: 192.168.1.1:25) Error connecting to server: Connection refused SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:40427 clnt: 10.0.1.1:2277 \ 8 serv: 192.168.1.1:25) fini
Without Enhanced Auto Discovery the inner channel is setup first before being checked if the service is actually reachable and available. Therefore both the client-side and the server-side Steelhead appliance will log about it:
Figure 9.11. Client-side Steelhead appliance, no service listening on TCP port 25, no Enhanced Auto Discovery
CSH sport[4511]: [splice/client.INFO] 3 {10.0.1.1:41527 192.168.1.1:25} init client 10.0.1 \ .1:41527 server 192.168.1.1:25 cfe 10.0.1.6:7801 sfe 192.168.1.6:7800 client connected \ : yes CSH sport[4511]: [splice/client.INFO] 3 {10.0.1.1:41527 192.168.1.1:25} Splice client side \ initializing: No protocol port = 25 protocol id = TCP(0) transport = TRANSPORT_ID_NON \ E CSH sport[4511]: [splice/client.INFO] 3 {10.0.1.1:41527 192.168.1.1:25} Start flowing, lpo \ rt 40270, rport 7800, OPOL_NORMAL, NAGLE_ALWAYS, PREOPT_NONE, LATOPT_AUTO, TRANSPORT_I \ D_NONE, TPTOPT_NONE(0x0) CSH sport[4511]: [decoder.INFO] 3 {10.0.1.1:41527 192.168.1.1:25} Warning: Inner channel d \ own prematurely, peer probably down; requesting shutdown CSH sport[4511]: [splice/client.INFO] 3 {10.0.1.1:41527 192.168.1.1:25} fini client 10.0.1 \ .1:41527 server 192.168.1.1:25 cfe 10.0.1.6:40270 sfe 192.168.1.6:7800 app TCP
Figure 9.12. Server-side Steelhead appliance, no service listening on TCP port 25, no Enhanced Auto Discovery
SSH sport[3073]: [splice/server.INFO] 3 {- -} init cfe 10.0.1.6:40270 sfe 192.168.1.6:7800 \ SSH sport[3073]: [splice/server.INFO] 3 {- -} sock 41 id 548627 client 10.0.1.1:41527 ser \ ver 192.168.1.1:25 remote inner port 7800 trpy TRPY_NONE SSH sport[3073]: [splice/server.INFO] 3 {- -} (clnt: 10.0.1.1:41527 peer: 10.0.1.6:40270 s \ erv: 192.168.1.1:25) Error connecting to server: Connection refused SSH sport[3073]: [splice/server.INFO] 3 {- -} fini client 10.0.1.1:41527 server 192.168.1. \ 1:25 cfe 10.0.1.6:40270 sfe 192.168.1.6:7800 app TCP
With Enhanced Auto Discovery the outer channel towards the server is tried to be setup before the inner channel is established. Since all failure is happening on the server-side Steelhead appliance, the client-side Steelhead appliance will not show any logging for this TCP session:
Figure 9.13. Server-side Steelhead appliance, no host with IP address 192.168.1.1, Enhanced Auto Discovery
SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:0 clnt: 10.0.1.1:65396 se \ rv: 192.168.1.1:25) init SSH sport[24255]: [splice/probe.INFO] 0 {- -} (locl: 192.168.1.6:40428 clnt: 10.0.1.1:6539 \ 6 serv: 192.168.1.1:25) fini
Without Enhanced Auto Discovery the inner channel is setup first before being checked if the service is actually reachable and available. Therefor there is also logging for this TCP session on the client-side Steelhead appliance.
Figure 9.14. Client-side Steelhead appliance, no host with IP address 192.168.1.1, no Enhanced Auto Discovery
CSH sport[4511]: [splice/client.INFO] 4 {10.0.1.1:31909 192.168.1.1:25} init client 10.0.1 \ .1:31909 server 192.168.1.1:25 cfe 10.0.1.6:7801 sfe 192.168.1.6:7800 client connected \ : no CSH sport[4511]: [splice/client.INFO] 4 {10.0.1.1:31909 192.168.1.1:25} Splice client side \ initializing: No protocol port = 25 protocol id = TCP(0) transport = TRANSPORT_ID_NON \ E CSH sport[4511]: [splice/client.INFO] 4 {10.0.1.1:31909 192.168.1.1:25} fini client 10.0.1 \ .1:31909 server 192.168.1.1:25 cfe 10.0.1.6:40272 sfe 192.168.1.6:7800 app TCP CSH kernel: [intercept.INFO] Peer 192.168.1.6:7800 is unreachable or incompatible. New con \ nections going through that peer will be passed through temporarily. CSH kernel: [intercept.INFO] Peer 192.168.1.6:7800 is unreachable or incompatible. New con \ nections going to server 192.168.1.1:25 through that peer using local inpath 10.0.1.6 \ will be passed through for at least 293 seconds.
Figure 9.15. Server-side Steelhead appliance, no host with IP address 192.168.1.1, no Enhanced Auto Discovery
SSH sport[3073]: [splice/server.INFO] 4 {- -} init cfe 10.0.1.6:40272 sfe 192.168.1.6:7800 \ SSH sport[3073]: [splice/server.INFO] 4 {- -} sock 43 id 548627 client 10.0.1.1:31909 ser \ ver 192.168.1.1:25 remote inner port 7800 trpy TRPY_NONE SSH sport[3073]: [splice/server.INFO] 4 {- -} fini client 10.0.1.1:31909 server 192.168.1. \ 1:25 cfe 10.0.1.6:40272 sfe 192.168.1.6:7800 app TCP
To setup a TCP session the client will send a maximum of three SYN packets. When the first SYN packet is intercepted by the Steelhead appliance and an optimized TCP session can be setup for it, it will put the TCP session in a NAT table and send a SYN+. If the second SYN packet is intercepted, it will just ignore it because an optimized is already being setup. If the third SYN packet is received and the optimized TCP session is not yet setup, it will just pass the SYN packet through and mark the TCP session as pass-through.
Figure 9.16. Third SYN received before inner channel got setup
SH kernel: [intercept.NOTICE] nat_check: SYN packet for already natted connection 10.0.1.1 \ :52181 -> 10.0.1.6:5486 ==> 10.0.1.1:52181 -> 192.168.1.6:7801
Some applications, for example the Windows SMB protocol, setup multiple TCP sessions at once and close the others when one of them gets setup successfully. It is possible that the inner channel for them hasn't been setup yet, and the following message is logged:
Figure 9.17. TCP session closed before the inner channel could have been setup
CSH sport[6693]: [splice/probe.NOTICE] 0 {- -} (locl: 10.0.1.6:50499 clnt: 10.0.1.1:2686 s \ erv: 192.168.1.1:139) No inner channel created for this probe splice