This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why RST, ACK after ACK

0

Hi,

Why would you normally see RST, ACK packets apparently in the middle of a transaction?

https://www.cloudshark.org/captures/3b405a6ad37b

Thanks

asked 22 Apr '13, 07:08

Mikecl's gravatar image

Mikecl
11113
accept rate: 0%

edited 22 Apr '13, 07:26

the link to cloudshark.org does not work.

UPDATE: I fixed the link

(22 Apr '13, 07:12) Kurt Knochner ♦

One Answer:

0

The RESET (Frame #699) of the client is an answer to the FIN of the server (Frame #697). The whole communication is a SSL/TLS session via port 8080 and apparently windows clients do close a SSL connection with a RESET instead of answering the FIN. See also this question:

http://ask.wireshark.org/questions/5533/rst-ack-immediately-after-sending-data

Based on the TTL and the window size of the SYN packet, I believe your client is a Windows XP system. I just (re-) verified that behavior with a Windows XP system and IE.

So, that's nothing to worry about, as you cannot change it anyways ;-))

Regards
Kurt

answered 22 Apr '13, 07:23

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 22 Apr '13, 07:26

Thanks Kurt,

Not quite clear what you mean, the Application People say that the Client sending the RESET is causing a problem, on the actual client as far as we know we are not closing the connection. This happens to multiple clients. Should I be able to see something different with Windows7

(22 Apr '13, 07:33) Mikecl

Not quite clear what you mean,

I mean, that there is nothing to do for you, as that's default behavior of some windows clients.

the Application People say that the Client sending the RESET is causing a problem,

What kind of problem?

Should I be able to see something different with Windows7

maybe. I did not check.

(22 Apr '13, 12:31) Kurt Knochner ♦