This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi Everyone,

I captured a trace of my network connection to the internet. I noticed there were a lot of reset packets being sent by the internet server - which was not surprising as my internet browser was not configured with my proxy address settings.

Now, my question is this: If I required access to the proxy server to browse, how come what was being displayed in Wireshark were the Ip addresses of the various internet servers I was trying to connect to? I thought that since the proxy server was blocking access, I should have seen it sending the TCP rest packers.

Could some one please put me explain this to me?

asked 30 Aug '13, 09:21

pontish's gravatar image

pontish
1111
accept rate: 0%


It probably is your firewall sending the resets, but spoofing the address of the web server you're trying to reach. TCP is connection-oriented. The reset must come from the IP address that the client was trying to reach, otherwise the client has no way of knowing what the reset is in response to.

permanent link

answered 30 Aug '13, 09:49

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Thanks. Sorry but one last question: is there any way to know for sure that it is the firewall spoofing the address of the website.

many thanks.

(30 Aug '13, 10:48) pontish

Capture on both sides of the firewall. If the traffic appears only on the inside, then the firewall replied on behalf of the web server. If the traffic appears on both sides of the firewall, then the traffic was passed on by the firewall and the reply came from some other device.

(30 Aug '13, 10:57) Jim Aragon
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×205
×27
×3

question asked: 30 Aug '13, 09:21

question was seen: 8,354 times

last updated: 30 Aug '13, 10:57

p​o​w​e​r​e​d by O​S​Q​A