Why do some machines respond with many RST packets instead of RST-ACK to refuse a connection?
- by Michael J. Gray
I have recently been trying to track down a problem with one of our systems and have noticed that it is simply not allowed to connect to a remote machine.
However, the remote machine (not controlled by us) is responding to our request for a connection with many TCP RST packets on a different port (26469, 26497, 26498) than the one we originated on (53).
It simply wouldn't let up at one point and flooded us with about 10 packets/second for an hour or two of only RST on those obscure high ports.
Out of the thousands of nodes we're connecting to, this is the only one ever to show this behavior. What could possibly cause this?
EDIT
Below is a screenshot of Wireshark when it happened. I don't have the actual dump anymore and can't reproduce this specific scenario every time. Basically, we sent a SYN and immediately got RST on an odd port and so we respond with RST and just keep going back and forth.