This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I've always wondered: What is the difference between a TCP RST and a RST,ACK?

thanks,

Geoff

asked 26 Feb '13, 11:15

GeoffP's gravatar image

GeoffP
40237
accept rate: 0%


I'm trying to refrain myself from answering with just "The ACK"...

permanent link

answered 26 Feb '13, 11:34

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

1

OK, I guess I failed at that ;-)

When I read the RFC, it seems to me that each RST should follow the normal acknowledgement rules. However, the sequence number is more important as to know whether or not the RST should be accepted by the receiving end.

See also the paragraph "Reset Generation" on p36 of RFC 793

(26 Feb '13, 11:42) SYN-bit ♦♦
1

well actually it's the ACK and the comma! ;-)

Honestly: There are so many rules when to use what in RFC 793, so there is no simple rule. Search for these strings in the RFC to find all occurrences:

<CTL=RST>
<CTL=RST,ACK

(26 Feb '13, 11:43) Kurt Knochner ♦

Thanks guys for the quick response. I know what SYN,ACKs are and RSTs.

I'm looking at a packet capture and I'm seeing RSTs and then moments later the same host is sending RST,ACKs. Hence leading to some confusion for me. After reading the RFC ("Reset Generation" section) above, it makes some more sense now.

(26 Feb '13, 11:52) GeoffP

If you can post the capture file somewhere, we may (or may not) be able to give an explanation for that behavior.

(26 Feb '13, 11:58) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139
×81
×61

question asked: 26 Feb '13, 11:15

question was seen: 10,608 times

last updated: 26 Feb '13, 11:58

p​o​w​e​r​e​d by O​S​Q​A