I have a Windows 2008 server and an application that connects over Internet to it.
From time to time I see that I receive a TCP [RST, ACK] that is ignored by my application.
Using TCPViewer I still can see that connection is still up.
I did different Wireshark captures and I can see that in case of the RST ignore, another packet is send back, and the connection is never dropped.
269037 72.5.42.235 172.16.1.138 TCP 60 9003?54020 [RST, ACK] Seq=2655287284 Ack=371936778 Win=0 Len=0
269038 172.16.1.138 72.5.42.235 TCP 66 [TCP Dup ACK 268965#33] 54020?9003 [ACK] Seq=371936778 Ack=2655238984 Win=2097120 Len=0 SLE=2655243124 SRE=2655287284
This usually happens when the connection is bad and I get a lot of latency, delayed packets and retransmissions.
Can somebody explain the situation when a [RST, ACK] may be ignored by an application or operating system?
Best Answer
A TCP connection is normally terminating using a special procedure where each side independently closes its end of the link. Connections are only a pair of two-way handshakes, not the normal 3-way handshake some people expect. Normal connection shutdown states are different at each end. It normally begins with one of the application processes signaling to its TCP layer that the session is no longer needed. That device sends a FIN message to tell the other device that it wants to end the connection, which is acknowledged. When the responding device is ready, it too sends a FIN that is acknowledged; after waiting a period of time for the ACK to be received, I believe its 4 mins, the session is closed.
The TCP protocol detects and responds to various problems that can occur during an established connection. One of the most common is the half-open connection. This occurs when one device closes the connection without the other one knowing about it, due to some problem with the connection, such as a bad network connection continuously flapping, which sounds like what you're experiencing. This means one device is in the ESTABLISHED state while the other may be in the CLOSED state, or some other transient state. This can cause states of the two devices to become unsynchronized.
TCP handles these half-open connections with the RST reset function, which is is generated whenever something happens that is “unexpected” by the TCP software.
Your client issued the RST, your http server ACK'd the RST, which should have closed the connection. However, because of the network flapping and the connection being half-open and unsynchronized, this caused some packet-loss or received out of order. This is why you also see the DUP ACK in your post.