3711801 - SAP Gateway Restarts Triggered by Vulnerability Scanning

• The SAP RFC Gateway service (sapgwXX) restarts automatically 
• The restarts occur randomly and not on all application servers at the same time.
• No manual restart is performed by administrators.
• The issue is observed intermittently.

Upon reviewing the dev_rd the following errors are recorded:

*****************************************************************************

       LOG Q0I=> NiIRead: P=<REMOTE_IP>:<PORT>; L=??? recv (73: Connection reset by peer)

       ERROR => NiIRead: SiRecv failed for hdl <HANDLE>/sock <SOCKET>

      (SI_ECONN_BROKEN/73; I4; ST; P=<REMOTE_IP>:<PORT>; L=<LOCAL_IP>:<PORT>)

*****************************************************************************

      *  LOCATION    SAP-Gateway on host <HOSTNAME> / <GW_INSTANCE>
      *  ERROR       connection to partner '<REMOTE_IP>:<PORT>' broken

*******************************************************************************

The <REMOTE_IP> address in the logs corresponds to a vulnerability scanning tool (for example, Nessus OS Vulnerability Scanner). 

• SAP NetWeaver
• SAP NetWeaver Application Server for SAP S/4HANA
• ABAP PLATFORM - Application Server ABAP

KBA , BC-CST-GW , Gateway/CPIC , Problem