Random and strange RST,ACKs

["Eduardo Tongson" <propolice () gmail com>]

---------- Forwarded message ----------
From: Eduardo Tongson <propolice () gmail com>
Date: Feb 28, 2007 6:07 PM
Subject: Random and strange RST,ACKs
To: pf () benzedrine cx
Hi folks,
I have this peculiar problem where the client over http is having
intermittent reset and timeouts. Doing a dump on the session I see
strange and random RST,ACKs. Here is a
snip:

No.     Time        Source       Destination           Protocol Info
     54 15.291306   CLIENT       SERVER         TCP      4813 > 88
[ACK] Seq=2857 Ack=7738 Win=64512 Len=0
     55 15.303536   CLIENT       SERVER         TCP      4813 > 88
[ACK] Seq=2857 Ack=9040 Win=64512 Len=0
     56 15.393751   CLIENT       SERVER         KRB5
Continuation[Unreassembled Packet]
     57 15.394190   SERVER         CLIENT       KRB5
Continuation[Unreassembled Packet]
     58 15.482484   CLIENT       SERVER         TCP      4814 > 88
[ACK] Seq=2117 Ack=8350 Win=64042 Len=0
     59 15.583039   CLIENT       SERVER         TCP      4813 > 88
[ACK] Seq=3337 Ack=9275 Win=64277 Len=0
     60 17.114978   CLIENT       SERVER         KRB5
Continuation[Unreassembled Packet]
     61 17.116075   CLIENT       SERVER         TCP      4814 > 88
[RST, ACK] Seq=2446 Ack=8350 Win=0 Len=0
     62 17.116481   SERVER         CLIENT       KRB5
Continuation[Unreassembled Packet]
     63 17.116585   SERVER         CLIENT       KRB5
Continuation[Unreassembled Packet]
     64 17.116694   SERVER         CLIENT       KRB5
Continuation[Unreassembled Packet]
     65 17.116703   SERVER         CLIENT       TCP      [TCP segment
of a reassembled PDU]
     66 17.214855   CLIENT       SERVER         TCP      4815 > 88
[SYN] Seq=0 Len=0 MSS=1260
     67 17.215060   SERVER         CLIENT       TCP      88 > 4815
[SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460

on 61 there is that sudden RST,ACK.

What might cause this?
By a long shot could it be a RST attack like the one described in
"Slipping the Window"?

TIA
- ed
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards