RST: Present in TCP frame

[kaushalshriyan]

Hi,

I have captured a tcpdump between Application server (Red Hat Enterprise Linux 8.10 Operating System) and Forcepoint Web Proxy server. When i try to analyse the pcap using wireshark gui tool

Postman REST API Client -> Application server -> Forcepoint Web Proxy server.

I see the below in Transmission Control Protocol frame in Wireshark GUI interface while loading the captured tcpdumpapplicationserver.pcap

RST: Present
FIN: Absent
Data: Present
ACK: Present
SYN-ACK: Present
SYN: Present

Is there a way to find out why we see RST: Present in TCP frame as mentioned above? Is it a normal TCP handshake flow or is the application sending RST flag as Present and because of this flag, the Forcepoint Web Proxy server abrupt the connections by sending RST flag to the Application server.

Please guide.

Best Regards,

Kaushal

[brb]

Hi,

Is there a way to find out why we see RST: Present in TCP frame as mentioned above

Are you asking whether we can see the reason for RST with pwru?

[kaushalshriyan]

@brb Yes, Is there a way to find out reason for RST flag using pwru? Thanks in advance.

[brb]

Yep, just give it a try. For example, on recent kernels, some logged packet drops contain a drop reason (kfree_skb_reason(...)).