Wireshark-users: Re: [Wireshark-users] RSK ACK
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Sat, 20 Sep 2008 23:08:01 +1000
Abhik Sarkar wrote:
> Since the RST comes immediately after a SYN, the source of the RST
> could also be a firewall between 10.119.31.11 and 172.27.1.5 which has
> been configured not to allow that kind of connection between those
> hosts.

That would be bad firewall design. Good design sends no responses for
blocked traffic so there is no hint as to whether the protected resource
even exists.

It would be easier to decide what is going on if we had all the raw
packets. If there are any firewalls in the path you might need to
capture the fraffic from both ends.

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who