Why do some machines respond with many RST packets instead of RST-ACK to refuse a connection?

Posted by Michael J. Gray on Server Fault See other posts from Server Fault or by Michael J. Gray
Published on 2012-11-04T14:53:59Z Indexed on 2012/11/04 17:04 UTC
Read the original article Hit count: 196

Filed under:
|
|

I have recently been trying to track down a problem with one of our systems and have noticed that it is simply not allowed to connect to a remote machine.

However, the remote machine (not controlled by us) is responding to our request for a connection with many TCP RST packets on a different port (26469, 26497, 26498) than the one we originated on (53).

It simply wouldn't let up at one point and flooded us with about 10 packets/second for an hour or two of only RST on those obscure high ports.

Out of the thousands of nodes we're connecting to, this is the only one ever to show this behavior. What could possibly cause this?

EDIT

Below is a screenshot of Wireshark when it happened. I don't have the actual dump anymore and can't reproduce this specific scenario every time. Basically, we sent a SYN and immediately got RST on an odd port and so we respond with RST and just keep going back and forth. RST Spam

© Server Fault or respective owner

Related posts about firewall

Related posts about tcp