This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

RST sequence number and window size

0

RFC793 states the following about RST processing: "In all states except SYN-SENT, all reset (RST) segments are validated by checking their SEQ-fields. A reset is valid if its sequence number is in the window."

But I'm not sure what does this statement means exactly. Let's say I have the following scenario:

alt text

So socket 2 tells socket 1 that its window size is 6 KB, and then socket 1 sends 6 KB worth of data to socket 2.

And then socket 1 decides to close the connection ungracefully, so it sends an RST packet to socket 2:

alt text

What will happen in this case, will this RST packet be accepted by socket 2 (will it be considered a valid packet)? If yes then why will it be accepted, I mean isn't this RST packet considered to be outside the window (since the window has already been filled by the 6 KB)?

asked 23 Mar '16, 20:38

john_9163's gravatar image

john_9163
16224
accept rate: 0%


One Answer:

0

That depends on timings and the TCP stack of the receiver. Some or all of your 6KB worth of data could have just been processed (pulled from the Window by the application) on socket 2 in the time the RST travels, so there's space again when the RST arrives - which would mean there's no problem.

If the RST arrives while the window is still full it's possible that the RST gets dropped, but in the end it's the stack that decides what to do. It may accept it nonetheless - you'd have to look at each individual TCP stack to check what it'll do.

answered 24 Mar '16, 10:39

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%