4

We are facing random RST packet problem in our environments, which causes some unexpected behaviors, following image is snapshot of the tcp data generated by wireshark, which shows the problem:

  1. Client (117.136.2.181) successfully sets up the connection with the server (192.168.40.16)
  2. Client sends some data to the server, as well the KEEP_ALIVE signal.
  3. Server receives the data, process it and sends the result back to client.
  4. Server close the socket.
  5. Server does not receive the ACK signal from client, so it re-transmits the result data as well as the FIN signal, this is automatically done by TCP protocol. However, server still does not receive the ACK signal from client.
  6. Server sends a RST signal to client so connection is closed.

TCP data packet

After some analysis, we think some network problem happens after step 3, so all the result data and FIN signal sent from server are not ack'd by client, but we are very confused about the RST signal sent from the server. Based on our understanding, a RST signal is sent if a half-closed socket receives some data, or if there is data in the receive queue when closes a socket. But both these seem not be the root cause of our case.

Can some one help to elaborate why this is happening?

Chris
  • 44,602
  • 16
  • 137
  • 156
asticx
  • 643
  • 2
  • 8
  • 14

1 Answers1

0

RST usually happens when close is called on the socket without shutdown, or after a shutdown while the other party is still trying to send data (still has not replied with an FIN).

Some programming languages have a socket.close(timeout) for example .NET, that calls shutdown then close after timeout has passed.

So the client have up to timeout to finish sending and closing the connection with FIN, if it fails to do so, the connection will be forcibly closed by RST.

See https://stackoverflow.com/a/23483487/1438522 for a more thorough explanation about difference between close and shutdown.

Ayoub Kaanich
  • 992
  • 8
  • 20