topic Re: tcpdump on r81.10 in General Topics

tcpdump on r81.10

Ihenock1011 — Fri, 19 Jul 2024 06:06:26 GMT

Hi All,

"I have a Checkpoint R81.10 gateway, and one of the servers is behind this gateway. There is an issue with the communication between two servers, and I took a TCP dump. When I open the captured data, there are a lot of TCP flags with reset [RST, ACK]. My question is, how do I know whether the reset is from the source side or the destination side, and what could be the possible reason behind this?

FYI I have attached the screenshot

Re: tcpdump on r81.10

Franktum — Fri, 19 Jul 2024 06:10:39 GMT

Hi,

One reason for RST, ACK is the destination server isn't listening through the port the source attacked. Check it out with netstat.

Regards

Re: tcpdump on r81.10

Ihenock1011 — Fri, 19 Jul 2024 07:39:14 GMT

@Franktum Yes, I did that, and the server is listening on that port.

Re: tcpdump on r81.10

the_rock — Fri, 19 Jul 2024 12:47:09 GMT

Can you email me directly and we can connect? That way you can email me the file and Im happy to check it for you. Hard to answer that question via screenshot.

Andy

Re: tcpdump on r81.10

the_rock — Fri, 19 Jul 2024 14:42:09 GMT

Just messaged you directly.

Andy

Re: tcpdump on r81.10

PhoneBoy — Fri, 19 Jul 2024 20:07:21 GMT

What it appears to mean is that previously sent data is acknowledged, but the connection is closing with a reset.
That would imply it's coming from the source.
See: https://networkengineering.stackexchange.com/questions/2012/why-do-i-see-a-rst-ack-packet-instead-of-a-rst-packet

Re: tcpdump on r81.10

Lesley — Fri, 19 Jul 2024 21:03:53 GMT

RST is more though way to end session

sender sends: RST

receiver sends RST (ACK) back, receiver tells the sender he acknowledges the RST packet.

Therefore the connection will be close.

Better way would be FIN -> FIN ack, that is better way to close but some system do it different.

RESET could also be an indication that the port you try to connect is closed.