54

Looking in Wireshark, I often see TCP Streams end with a RST, ACK packet instead of a RST packet. Anyone know why this is?

An example of what I see:

SYN SYN, ACK ...data... RST, ACK

Wireshark is not picking up a RST packet prior to the RST, ACK packet.

4
  • 2
    Why do you think there should be a RST segment before RST/ACK? Maybe you could provide an example of such a packet trace?
    – Gerben
    Jun 21, 2013 at 20:37
  • Did the ACK piggyback the RST in the same packet? Jun 22, 2013 at 5:14
  • I ACK u sent request\data end connection End connection= RST
    – motoko
    Sep 10, 2018 at 0:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 3, 2021 at 1:13

2 Answers 2

67

A RST/ACK is not an acknowledgement of a RST, same as a SYN/ACK is not exactly an acknowledgment of a SYN. TCP establishment actually is a four-way process: Initiating host sends a SYN to the receiving host, which sends an ACK for that SYN. Receiving host sends a SYN to the initiating host, which sends an ACK back. This establishes stateful communication.

SYN --> 
    <-- ACK
    <-- SYN
ACK -->

To make this more efficient, the receiving host can ACK the SYN, and send its own SYN in the same packet, creating the three-way process we are used to seeing.

SYN -->
    <-- SYN/ACK
ACK -->

In the case of a RST/ACK, The device is acknowledging whatever data was sent in the previous packet(s) in the sequence with an ACK and then notifying the sender that the connection has closed with the RST. The device is simply combining the two packets into one, just like a SYN/ACK. A RST/ACK is usually not a normal response in closing a TCP session, but it's not necessarily indicative of a problem either.

3
  • 8
    An example scenario of sending RST/ACK is when the receiving host is not listening on the destination TCP port.
    – Indika K
    Sep 15, 2014 at 9:12
  • Yes indeed. I once tried to simulate a DDoS attack (for educative purpose ;) ) from machine A to a machine B on port 80. But B's 80 port is not open. So I can see machine B send lots of RST ACK response to the faked source address. Sep 5, 2015 at 9:18
  • Can RST/ACK response depend on the packet content? I.e. server receives the packet and because the packet content matched some condition, the session was closed.
    – skooog
    Aug 7, 2018 at 14:46
1

Once the connection is established, all packets need to have ACK set and match the sequence number of the received packets for reliable transport/security. RST without ACK will not be accepted. When one side sends RST, the socket is closed immediately and the receiving side also closes the socket immediately after receiving valid RST. It does not need to be and can't be acknowledged.

after TCP handshake

A --->B Syn=x, Ack=y, len=z, ACK Flag

B --->A Syn=y, Ack=x+z, len=o, ACK Flag

A --->B Syn=x+z, Ack=y+o, len=p, ACK Flag

B --->A Syn=y+o, ACK=x+z+p,len=q, RST, ACK Flag

B closes the socket after it sends the last packet and A closes the socket after it receives it.

(not considering TCP window here, or there might be more packets from one end before the acknoledgement)

ACK Flag, acknowledgement number and the procedure of acknowledgement are related but not the same thing.

Per RFC793

RFC793

Acknowledgment Number: 32 bits

If the ACK control bit is set this field contains the value of the
next sequence number the sender of the segment is expecting to
receive.  Once a connection is established this is always sent.

Reset Processing

In all states except SYN-SENT, all reset (RST) segments are validated by checking their SEQ-fields. A reset is valid if its sequence number is in the window. In the SYN-SENT state (a RST received in response to an initial SYN), the RST is acceptable if the ACK field acknowledges the SYN.

The receiver of a RST first validates it, then changes state. If the receiver was in the LISTEN state, it ignores it. If the receiver was in SYN-RECEIVED state and had previously been in the LISTEN state, then the receiver returns to the LISTEN state, otherwise the receiver aborts the connection and goes to the CLOSED state. If the receiver was in any other state, it aborts the connection and advises the user and goes to the CLOSED state.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.