["Jim Hendrick" <jrhendri@xxxxxxxxxxxx>]

Sounds like someone mapping your server with a classic SYN scan (look at
nmap). 

The "client" looks for open services this way. Sending a SYN, waiting for a
SYN/ACK (indicating a listening service) and replying with a RST (not
causing the connection to be opened, which would get logged on the server,
but letting the scanner (client) know that a service is alive and reachable.

Later,
Jim

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Matt Kopf
Sent: Wednesday, August 04, 2004 4:26 PM
To: 'Ethereal user support'
Subject: [Ethereal-users] RST flag question


Doing some monitoring on a network link that goes over a Cisco router I saw
many times where the computer on the other end will start the handshake
process, the server answered and then a RST from the client. So the question
is:

Can the router set the RST flag?

What would cause the OS (windows) to set the RST flag?

Thanks for the help.

Matt Kopf

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users