0

I would like to know what RST does when establishing TCP connection

Firewall Log

id="1" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" srcip="x.x.x.x" dstip="172.16.x.x" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="49670" tcpflags="RST"

The above packet is being dropped and I dont know why..

Could anyone explain what RST does and why it is being dropped?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 21 '20 at 17:32
2

RST == Reset Connection

It has nothing to do with establishing a TCP connection. It's used to close a connection, either due to error or as a means to (rapidly) bypass the normal FIN closing sequence.

Most likely you are seeing a RST after the connection is already closed and the firewall no longer has any state for it. (172.16 suggests NAT. Without a NAT translation, the FW has no idea where to send the packet, thus it's dropped.) However, the firewall my have an explicit rule to drop all RST packets as a "security" feature. (eg: TCP Reset Attack)

2
  • Could you please explain how to do NAT for the RST packet?
    – paddy24
    Jan 8 '15 at 0:13
  • You don't. That's the whole point... the connection has closed already. Any state/context for that connection is gone. Any subsequent traffic for that connection will be dropped as random nonsense by the firewall. (translation: just ignore it.)
    – Ricky
    Jan 8 '15 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.