Prev: Dead iBook - help?
Next: SynergyKM
From: Michael H. Phillips on 28 Oct 2006 07:18
Having a gander at my router's logs, I see that I am getting a lot of "TCP
Reset" messages. Taking a one-hour period, there are 34 "Peer TCP state out
of order, sent TCP RST" entries and 4 "Firewall session time out, sent TCP
RST" entries.
Is this to be expected or is something rotten?
It's all double-Dutch to me.

--
Michael

mhphillips at gmail dot com

From: Norbert Lieckfeldt on 28 Oct 2006 07:22
In article <0001HW.C168FB200009BB78F0305530(a)news.cable.ntlworld.ie>,
Michael H. Phillips <mhp(a)odtaa.invalid> wrote:

> Having a gander at my router's logs, I see that I am getting a lot of "TCP
> Reset" messages. Taking a one-hour period, there are 34 "Peer TCP state out
> of order, sent TCP RST" entries and 4 "Firewall session time out, sent TCP
> RST" entries.
> Is this to be expected or is something rotten?
> It's all double-Dutch to me.

Very detailed possible explanation here: http://kerneltrap.org/node/3072

N.
From: Michael H. Phillips on 29 Oct 2006 05:35
On Sat, 28 Oct 2006 12:22:11 +0000, Norbert Lieckfeldt wrote:

> In article <0001HW.C168FB200009BB78F0305530(a)news.cable.ntlworld.ie>,
> Michael H. Phillips <mhp(a)odtaa.invalid> wrote:
>
>> Having a gander at my router's logs, I see that I am getting a lot of "TCP
>> Reset" messages. Taking a one-hour period, there are 34 "Peer TCP state out
>> of order, sent TCP RST" entries and 4 "Firewall session time out, sent TCP
>> RST" entries.
>> Is this to be expected or is something rotten?
>> It's all double-Dutch to me.
>
> Very detailed possible explanation here: http://kerneltrap.org/node/3072
>
> N.

Too detailed for this bear of little brain.

--
Michael

mhphillips at gmail dot com

From: Chris Ridd on 29 Oct 2006 07:18
On 2006-10-29 11:35:48 +0100, Michael H. Phillips <mhp(a)odtaa.invalid> said:

> On Sat, 28 Oct 2006 12:22:11 +0000, Norbert Lieckfeldt wrote:
>
>> In article <0001HW.C168FB200009BB78F0305530(a)news.cable.ntlworld.ie>,
>> Michael H. Phillips <mhp(a)odtaa.invalid> wrote:
>>
>>> Having a gander at my router's logs, I see that I am getting a lot of
>>> "TCP Reset" messages. Taking a one-hour period, there are 34 "Peer TCP
>>> state out of order, sent TCP RST" entries and 4 "Firewall session time
>>> out, sent TCP RST" entries.
>>> Is this to be expected or is something rotten?
>>> It's all double-Dutch to me.
>>
>> Very detailed possible explanation here: http://kerneltrap.org/node/3072
>>
>> N.
>
> Too detailed for this bear of little brain.

I think the management summary is this is OK. Pressing "Cancel" in a
web browser is probably enough to cause a few of the "sent TCP RST"
messages, and connection time outs are the cause for the other.

One of the things the article was talking about is that there's a way
for a Bad Guy to close network connections on your machine from afar by
spoofing RST packets. Most firewalls can detect these attacks and
nullify them.

Cheers,

Chris

From: Michael H. Phillips on 29 Oct 2006 09:44
On Sun, 29 Oct 2006 12:18:04 +0000, Chris Ridd wrote:

> On 2006-10-29 11:35:48 +0100, Michael H. Phillips <mhp(a)odtaa.invalid> said:
>
>> On Sat, 28 Oct 2006 12:22:11 +0000, Norbert Lieckfeldt wrote:
>>
>>> In article <0001HW.C168FB200009BB78F0305530(a)news.cable.ntlworld.ie>,
>>> Michael H. Phillips <mhp(a)odtaa.invalid> wrote:
>>>
>>>> Having a gander at my router's logs, I see that I am getting a lot of
>>>> "TCP Reset" messages. Taking a one-hour period, there are 34 "Peer TCP
>>>> state out of order, sent TCP RST" entries and 4 "Firewall session time
>>>> out, sent TCP RST" entries.
>>>> Is this to be expected or is something rotten?
>>>> It's all double-Dutch to me.
>>>
>>> Very detailed possible explanation here: http://kerneltrap.org/node/3072
>>>
>>> N.
>>
>> Too detailed for this bear of little brain.
>
> I think the management summary is this is OK. Pressing "Cancel" in a
> web browser is probably enough to cause a few of the "sent TCP RST"
> messages, and connection time outs are the cause for the other.
>
> One of the things the article was talking about is that there's a way
> for a Bad Guy to close network connections on your machine from afar by
> spoofing RST packets. Most firewalls can detect these attacks and
> nullify them.

That's clear. Nothing to worry about, then. Thanks Chris.

--
Michael

mhphillips at gmail dot com

 | 
Pages: 1
Prev: Dead iBook - help?
Next: SynergyKM