Internet Core Protocols: The Definitive Guide

Lots of Reset Command Segments

A high number of TCP command segments with the Reset flag enabled can indicate a variety of things, although typically it boils down to the recipient getting a segment that “apparently is not intended for the current connection,” according to RFC 793. However, RFC 793 also goes on to state that “A reset must not be sent if it is not clear that this is the case,” leaving it up to the recipient to make the decision.

For example, Reset segments will be sent whenever a remote endpoint attempts to establish a connection to a non-existent socket on the local system. If a web browser tries to establish a connection to port 80 (the well-known port number for HTTP), but there is no server listening on that port, then the local system’s TCP stack should return a Reset segment in response to the incoming Synchronize requests.

Reset segments can also be sent if the local socket is no longer valid for a previous connection. In that case, the local application has completely closed its end of the connection but the remote system is still sending data. When those segments arrive, the local TCP stack should just reply with an equal number of Reset segments. This can happen due to the remote endpoint refusing to close their end of the connection after the local system has sent the requisite circuit-termination segments (using the Finish flag), and can also occur if the virtual circuit had to be destroyed due to an excessive number of retransmissions. In both of those ...