CODEWITHSUNDEEP
linuxtcpprotocolsfirewall
Satish
Satish

Reputation: 17397

TCP strange RST packet terminating connection

The question is we have the following setup and we have noticed sometime client sends RST packet to terminate initial TCP handshake connection and application gets a timeout.

[10.5.8.30]------[Linux FW]-------[10.5.16.20]

Wireshark:

You can see in Wireshark RST packet, I thought its FW sending RST but in capture packet coming from 10.5.8.30 so what could be wrong here? why connection getting reset randomly, if I try next time then it will work.

enter image description here

Upvotes: 0

Views: 2316

Answers (1)

Malt
Malt

Reputation: 30285

The fact that the source IP for the RST packet is 10.5.8.30 doesn't mean that it really came from 10.5.8.30.

There are firewalls and various other intermediary devices that forge such packets. Try capturing on both ends to check whether 10.5.8.30 did, in fact, send the RST. It doesn't make sense for a client to send a TCP Syn and then a RST.

Upvotes: 1

Related Questions