dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
36
johnmwilson7
join:2007-08-30
Washington, DC

3 edits

johnmwilson7 to funchords

Member

to funchords

Re: How to test how many connections are being reset by RST pack

FunChords,

Using the following filter string

"(ip.src != your.ip.addr.ess) and (tcp.flags.reset == 1)"

I was able to get a steady display of incoming resets. Of course most would be normal. However looking at the list, which ones should I consider to be suspect?

Sincerely,

John M. Wilson

funchords
Hello
MVM
join:2001-03-11
Yarmouth Port, MA

funchords

MVM

The ones where Seq>1 and Ack>1 in the display (generally this means that data has already passed both ways, even if it was just a handshake).