This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

RST ACK from the server

0
1

Hi All,

Please advise on the below. I checked and RST-ACK is like FIN-ACK to close the connection. The problem is when this happens the webpage is not displayed.

Say the TCP session is between 10.1.1.1 and 10.1.1.2

10.1.1.1---->syn 10.1.1.2

10.1.1.2---->syn-ack 10.1.1.1

10.1.1.1---->ack 10.1.1.2

------Omittied the data transfer-------

10.1.1.1 -->RST,ACk 10.1.1.2

Question:

1)Without the (Fin-ACK) from 10.1.1.2, can 10.1.1.1 send (RST-ACK)?

2)If the above is yes, should 10.1.1.2 send (FIN-ACK) after (RST-ACK)? 3)Is the above Communication valid between the server and the client?

Thanks

asked 14 Nov '15, 00:12

rakeshreddy's gravatar image

rakeshreddy
5346
accept rate: 0%


One Answer:

1

1) Yes, the server can actively terminate the connection any time it considers appropriate.

2) When the client gets the RST packet it makes no sense to send a FIN as the remote socket is no longer there to ACK it.

3) It causes the passive side to see a broken connection so it's not nice but valid and it's not uncommon to see a RST (abortive close) these days

From http://stackoverflow.com/questions/3757289/tcp-option-so-linger-zero-when-its-required

When to use SO_LINGER with timeout 0

... according to "UNIX Network Programming" third edition page 202-203, setting SO_LINGER with timeout 0 prior to calling close() will cause the normal termination sequence not to be initiated.

Instead, the peer setting this option and calling close() will send a RST (connection reset) which indicates an error condition and this is how it will be perceived at the other end. You will typically see errors like "Connection reset by peer".

Therefore, in the normal situation it is a really bad idea to set SO_LINGER with timeout 0 prior to calling close() – from now on called abortive close – in a server application.

answered 14 Nov '15, 23:24

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Thanks. Make sense.

(14 Nov '15, 23:36) rakeshreddy