This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the difference between RST and RST,ACK?

0

I've always wondered: What is the difference between a TCP RST and a RST,ACK?

thanks,

Geoff

asked 26 Feb '13, 11:15

GeoffP's gravatar image

GeoffP
40●2●3●7
accept rate: 0%

One Answer:

0

I'm trying to refrain myself from answering with just "The ACK"...

answered 26 Feb '13, 11:34

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

1

OK, I guess I failed at that ;-)

When I read the RFC, it seems to me that each RST should follow the normal acknowledgement rules. However, the sequence number is more important as to know whether or not the RST should be accepted by the receiving end.

See also the paragraph "Reset Generation" on p36 of RFC 793

(26 Feb '13, 11:42) SYN-bit ♦♦
1

well actually it's the ACK and the comma! ;-)

Honestly: There are so many rules when to use what in RFC 793, so there is no simple rule. Search for these strings in the RFC to find all occurrences:

<CTL=RST>
<CTL=RST,ACK

(26 Feb '13, 11:43) Kurt Knochner ♦

Thanks guys for the quick response. I know what SYN,ACKs are and RSTs.

I'm looking at a packet capture and I'm seeing RSTs and then moments later the same host is sending RST,ACKs. Hence leading to some confusion for me. After reading the RFC ("Reset Generation" section) above, it makes some more sense now.

(26 Feb '13, 11:52) GeoffP

If you can post the capture file somewhere, we may (or may not) be able to give an explanation for that behavior.

(26 Feb '13, 11:58) Kurt Knochner ♦