I have recently been trying to track down a problem with one of our systems and have noticed that it is simply not allowed to connect to a remote machine.
However, the remote machine (not controlled by us) is responding to our request for a connection with many TCP RST
packets on a different port (26469, 26497, 26498) than the one we originated on (53).
It simply wouldn't let up at one point and flooded us with about 10 packets/second for an hour or two of only RST
on those obscure high ports.
Out of the thousands of nodes we're connecting to, this is the only one ever to show this behavior. What could possibly cause this?
EDIT
Below is a screenshot of Wireshark when it happened. I don't have the actual dump anymore and can't reproduce this specific scenario every time. Basically, we sent a SYN
and immediately got RST
on an odd port and so we respond with RST
and just keep going back and forth.
TCP 192.168.0.10:53
and you got to that host on tcp/80? I find this mildy odd, but however, that trace above shows normal behaviour. But since this in not the real scenario, I want to ask if you do the same to the real host. You come from 53 and go to 80, but you get RST/ACK from totally differnt ports form the remote host?RST
and the varying ports were due to not reading the output an additional time. But, still there should be aRST-ACK
coming back and not justRST
!