dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
30
share rss forum feed

johnmwilson7

join:2007-08-30
Washington, DC

3 edits
reply to funchords

Re: How to test how many connections are being reset by RST pack

FunChords,

Using the following filter string

"(ip.src != your.ip.addr.ess) and (tcp.flags.reset == 1)"

I was able to get a steady display of incoming resets. Of course most would be normal. However looking at the list, which ones should I consider to be suspect?

Sincerely,

John M. Wilson


funchords
Hello
Premium,MVM
join:2001-03-11
Yarmouth Port, MA
kudos:6
The ones where Seq>1 and Ack>1 in the display (generally this means that data has already passed both ways, even if it was just a handshake).