The TCP RST flag resets the connection. It indicates that the receiver should delete the connection. The receiver deletes the connection based on the sequence number and header information. If a connection doesn't exist on the receiver RST is set, and it can come at any time during the TCP connection lifecycle due to abnormal behavior. Let's take one example: a RST packet is sent after receiving SYN/ACK, as shown in the next image.

RST after SYN-ACK

In this example we will see why RST has been set after SYN-ACK instead of ACK:

Open the RST-01.pcap file in the Wireshark:

As you can see in the preceding figure:

• The TCP RST packet should not be seen normally

• The TCP RST is set after the first two handshakes are complete. A possible explanation could be one of the following:

  • The client connection...