Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Solaris 10 using snoop to capture packets.

When I telnet to an unused IP address, and wait for the connection attempt to time out, everything behaves as expected (SYNs sent several times until connection establishment time out exceeded, then telnet quits).

When do the same thing, but cancel the attempt before it reaches the time out, with control-c, the last packet has a RSET.

Is this done for a reason? Maybe the network stack is assuming that the SYNs were successful, even if the SYN-ACK didn't come back, so it sends a RSET to keep the remote system from being left half-open?

I had read Stevens TCP/IP Illustrated, Vol 1 a long time ago, and I don't recall this being discussed (I checked with a quick google, but didn't dig up the book).

share|improve this question
+1 for reading TCP/IP Illustrated. It's without a doubt one of the most comprehensive (and complex) tomes on TCP/IP. I only wish that I understood the half of it. – joeqwerty Sep 9 '11 at 2:37

As you suspect - it's as a just-in-case measure to notify the remote host to abort the connection attempt; for all your system knows, the host sent back a SYNACK and you didn't get it.

It's basically a "hey, remote host, if you tried to connect back to me, you can go ahead and stop".

share|improve this answer

TCP doesn't allow for a session to be in an ambiguous state, whether that session is established or in the process of being established. It needs to terminate the connection or the connection attempt gracefully in the sense that it won't just abort the connection without sending either a FIN or a RST (as far as I know).

That's not to say that a session can never be in an ambiguous state due to factors outside the purview of TCP, such as a broken link which causes a half-open on one end of the session. From the point of view of TCP, a half-open connection is simply a connection that is long idle (unless TCP keep-alive is implemented).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.