Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

asked 2024-09-27 13:02:34 +0000

kaushalshriyan gravatar image

RST: present, Fin: Absent, DATA: Present, ACK:

Hi,

I have captured a tcpdump between Application server and Forcepoint Web Proxy server. When i try to analyse the pcap using wireshark gui tool

Postman REST API Client -> Application server -> Forcepoint Web Proxy server.

I see the below in Transmission Control Protocol frame in Wireshark GUI interface while loading the captured tcpdumpapplicationserver.pcap

RST: Present FIN: Absent Data: Present ACK: Present SYN-ACK: Present SYN: Present

Is there a way to find out why we see RST: Present in TCP frame as mentioned above? Is it a normal TCP handshake flow or is the application sending RST flag as Present and because of this flag, the Forcepoint Web Proxy server abrupt the connections by sending RST flag to the Application server.

Please guide.

Best Regards,

Kaushal

click to hide/show revision 2
None

updated 2024-09-27 14:47:42 +0000

Chuckc gravatar image

RST: present, Fin: Absent, DATA: Present, ACK:

Hi,

I have captured a tcpdump between Application server and Forcepoint Web Proxy server. When i try to analyse the pcap using wireshark gui tool

Postman REST API Client -> Application server -> Forcepoint Web Proxy server.

I see the below in Transmission Control Protocol frame in Wireshark GUI interface while loading the captured tcpdumpapplicationserver.pcap

RST: Present 

**RST: Present** 
FIN: Absent 
Data: Present 
ACK: Present
SYN-ACK: Present
SYN: Present
Present

Is there a way to find out why we see RST: Present in TCP frame as mentioned above? Is it a normal TCP handshake flow or is the application sending RST flag as Present and because of this flag, the Forcepoint Web Proxy server abrupt the connections by sending RST flag to the Application server.

Please guide.

Best Regards,

Kaushal