Search code examples
tcpportwireshark

What is the purpose of "RST" flag?

I scanned my metasploitable machine for open ports from Kali using Nmap and captured the traffic using Wireshark and noticed that for every SYN packet sent to an open port, a RST packet was sent as well. Why?

Solution

  • Read RFC 793 3.4 to learn more about reset packets. In your case, the explanation is :

    1.  If the connection does not exist (CLOSED) then a reset is sent
in response to any incoming segment except another reset.  In
particular, SYNs addressed to a non-existent connection are rejected
by this means.