I have recently been trying to track down a problem with one of our systems and have noticed that it is simply not allowed to connect to a remote machine.
However, the remote machine (not controlled by us) is responding to our request for a connection with many TCP
RST packets on a different port (26469, 26497, 26498) than the one we originated on (53).
It simply wouldn't let up at one point and flooded us with about 10 packets/second for an hour or two of only
RST on those obscure high ports.
Out of the thousands of nodes we're connecting to, this is the only one ever to show this behavior. What could possibly cause this?
Below is a screenshot of Wireshark when it happened. I don't have the actual dump anymore and can't reproduce this specific scenario every time. Basically, we sent a
SYN and immediately got
RST on an odd port and so we respond with
RST and just keep going back and forth.