Large number of RST-SYN

TCP-reset

asked 2019-03-18 19:08:20 +0000

aasalem

1 ●3 ●3

updated 2019-03-19 11:06:29 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Am truing to tune this pc and not sure what and why this large number of RSTs are coming from.

1   0.000000000 127.0.0.1   127.0.0.1   TCP 76  45689 → 42385 [SYN] Seq=0 Win=43690 Len=0 MSS=65495 SACK_PERM=1 TSval=4151242101 TSecr=0 WS=128
116 33.035618863    127.0.0.1   127.0.0.1   TCP 56  42385 → 39483 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

Linux alaa-HP-Pavilion-dv2700-Notebook-PC 4.15.0-46-generic #49~16.04.1-Ubuntu SMP Tue Feb 12 17:44:38 UTC 2019 i686 athlon i686 GNU/Linux

Scanned with clam.

https://drive.google.com/open?id=17Wn...

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-03-21 10:57:36 +0000

Kurt Knochner
24722 ●10 ●44 ●239 Munich, Germany

There is no service listening on port 42385. Not sure if you anonymized the pcap (127.0.0.1), or if you captured on localhost. Based on the delta time between SYN and RST, I tend to believe you captured on localhost. So, try to figure out which process is trying to connect to port 42385.

Run the following command and either check yourself or post here.

netstat -nap | grep 42385

Regards
Kurt

edit flag offensive delete link

add a comment

answered 2019-03-21 10:22:44 +0000

atom
1 ●2 ●4 ●3

Maybe you could find out what application listens on port 42385.

edit flag offensive delete link

Comments

I think there is nothing listening on port 42385, hence the resets. I think the issue is more about what process is continually sending the SYN to port 42385, from a random bunch of ephemeral ports. I'm not sure what tools are available on Linux to help with that, maybe lsof?

grahamb ( 2019-03-21 10:58:38 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Large number of RST-SYN

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

Large number of RST-SYN edit

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

Large number of RST-SYN