is the RST ACK packet in wireshark normal?

133 views Asked by At

wireshark capture

when i try to analyse the trafic in the network with wireshark software i see packets with red color (RST ACK) . is that a normal trafic packet or there are some things wrongs?and if there are an erreur haw to fix it please?

1

There are 1 answers

0
elalitte On

RST flag in packets mean that the receiving machine decided to stop the connection. This usually happen when you try to reach a port on a machine that is not listening.

If I try to send a request to port 80 on the machine 192.168.1.1, but this machine has no service working on that port.

Receiving the SYN packet from my machine, the 192.168.1.1 machine should reply with a RST packet (RST + ACK to acknowledge the SYN packet) to tell my machine that there is no service turning on that port.

Thus having RST + ACK packets on your network is quite normal. If you have a lot of them it could be the result of someone scanning port on a machine.

(RST packets are also send in a TCP connection if on of the machine implied in the connection thinks that the connection is desynchronized, but it is not that usual)