print

Tip of the Month

May 2000

Understanding TCP Resets

Setting up your protocol analyzer to trigger on packets that have the TCP RST (reset) bit set can be a valuable aid in troubleshooting and even intrusion detection. When capturing such packets, you will need to examine the packets to determine the cause of the problem. Here are some possible scenarios:

1. If a user runs an application such as Telnet and tries to establish a TCP connection (by sending a TCP SYN) to an IP host and no Telnet process is listening on the standard TCP Telnet port (23), then the host will send back a TCP packet with the RST bit set.

2. In another case, one side of a TCP connection can send a RST in the middle of a conversation. This usually means that the sender is aborting any queued TCP segments. This is sometimes called an "abortive" release compared to an "orderly" TCP disconnect performed by sending a TCP packet with the FIN flag set.

3. Yet another possibility is that the host has "timed out" a user connection or has been rebooted during a session with a client. If the client tries to use previously established TCP connection with the host, then the host will send a RST back to the client. This is sometimes referred to as closing a "half" session.

Note that in scenario #1, hundreds of RST packets sent back to a client could indicate TCP port scanning activity.