What causes "TCP error 2 {0} Foreign tcp client" error message in wvlog.txt?

[LindaYu]

What causes "TCP error 2 {0} Foreign tcp client" error message in wvlog.txt?

Example of the full message:

2023-05-20 12:02:48 00004600 IRNETRTR 00,1019 tcpic 07127 11.9.0
TCP error 2 {0} Foreign tcp client(10.1.1.1:12345) connected
netrtr(127.0.0.1:1960)(0) sock 29; bytes total 18, bytes_last_read 18 -
received data is being discarded.

[LindaYu · Accepted solution]

Root cause:

This error is normally triggered by a port scan or penetration test performed against the server Prognosis is running on. You should contact your internal security team to determine if this was internal. If not, it may be the result of an external attempt to access this server.

Impact: 

This type of unexpected connection attempt will cause the IRNETRTR process to stop accepting new connections. For example, new IRGUI connection to connect to Prognosis service would fail.

Solution:

To recover from this scenario, you will normally need to restart Prognosis service. Sometimes, restarting IRNETRTR process can resolve this too.

If this issue occurs regularly as a result of security scanning, you may be able to prevent this type of connection on Windows or Linux/Unix system by blocking the source IP of the scanning server via the local firewall or adding an exclusion for tour Prognosis server's IP address to your security/port scanning application.