0

I am creating simple TCP simulation program that can act as a simple TCP server over IP, the problem is in my code I coded when I receive SYN packet, --> I do all the response packet formulation in my program server and creation of response packet and reply with SYN+ACK packet.

But right after I reply with SYN+ACK packet I get RST packet from the client socket. I have no clue whats wrong with my TCP or some headers that making my client socket to just go about reply my SYN+ACK packet with RST packet.

I read on the internet about RST packet that It says RST received on host for two reasons, but can be more reasons

There are a few circumstances in which a TCP packet might not be expected; the two most common are:

    The packet is an initial SYN packet trying to establish a connection to a server port on which no process is listening.
    The packet arrives on a TCP connection that was previously established, but the local application already closed its socket or exited and the OS closed the socket.

So I like to know what is the reason in my case given.

When I received SYN packet on program IP socket

0000   45 00 00 3c 81 37 40 00 40 06 24 11 c0 a8 0a 14
0010   c0 a8 0a 0f ba 50 00 50 15 1a 68 41 00 00 00 00
0020   a0 02 fa f0 a3 ce 00 00 02 04 05 b4 04 02 08 0a
0030   de d7 fc f8 00 00 00 00 01 03 03 07

I reply with SYN+ACK packet. my TCP packet looks like this

0000   45 00 00 28 00 64 40 00 40 06 a4 f8 c0 a8 0a 0f
0010   c0 a8 0a 14 00 50 ba 50 00 01 00 00 15 1a 68 41
0020   50 12 fa f0 e7 70 00 00

So fields in TCP are like above in 20 (IP header)+20 (TCP header) bytes of packet (SYN+ACK) for SYN+ACK replying from my code to client socket. but instead of start of data sending from client, my client start sending RST packets and in my code I get RST packet right after I send SYN + ACK packet from my code to client socket.

But what is the thing in above headers values that I get RST packet (reset packet) instead of getting some data from client or at least my client sockets [connect()] function call gets succeed? How to make this RST packet from my client sending go away so my client finally start sending data and my server code start getting data? What am I doing wrong?

1
  • what happened with the code that sets ACK to the sequence number in SYN + 1? you receive SYN packet with SEQ 15 1a 68 41 and reply with SYNACK with ACK 15 1a 68 41. This does not look like SEQ+1.
    – Effie
    Dec 30, 2021 at 11:12

2 Answers 2

2

I don't see something inherently wrong with this packet, but the packet must be taken in the context of the SYN. The expected sequence number for the ACK in SYN+ACK is the sequence number from the SYN (ISN, i.e. initial sequence number) plus 1.

But, the ACK is not ISN+1, instead it is simply ISN from the received SYN. This means that the SYN+ACK is out of order and thus causes the RST.

4
  • if the ACK in your packet does not fit the sequence number in the received SYN. so are u saying that my SYN + ACK packet has wrong sequence number. Can u please tell what should be the sequence number of my SYN + ACK reply packet if I received SYN packet. I tried doing like assigning received SYN's sequence number to my SYN + ACK's acknowledgement number in reply packet but my client still giving me RST flag
    – user786
    Dec 30, 2021 at 10:49
  • @user786: Please edit your question to add the SYN like you did in your (closed) post at Network Engineering. As for how the sequence numbers should be - see for example media.geeksforgeeks.org/wp-content/uploads/TCP-connection-1.png Dec 30, 2021 at 10:52
  • Question is updated with SYN packet. Can u please take a look
    – user786
    Dec 30, 2021 at 11:14
  • @user786: see updated answer. Dec 30, 2021 at 11:35
1

The general reason for sending RST, is that the receiver cannot find a socket, that incomming packet should be attributed to.

Common cases include:

  • mismatched ports: there is no open socket for the port pair
  • mistmatched sequence numbers: ACK number is incorrect, or ACK number does not fit within sender's window (here sender is the side that has received an ACK, because ACK is a response to sender sending something)

According to TCP specification, packets with SYN (and also FIN) flags set, are acknowledged with ACK numbers increased by one, i.e., as if these flags occupied one byte of data.


Considering both received SYN and sent SYNACK, one can see, that sequence number in SYN is 15 1a 68 41 and ACK number in SYNACK is also 15 1a 68 41, which is not SYN + 1 as it should be.

P.S.: structure of TCP header can be found in e.g., wikipedia. An explanation how to match packet bytes to header fields can be found in this answer. Also, an illustration of sender window can be found here.

5
  • or ACK number does not fit within sender's window (here sender is the side that has received an ACK, because ACK is a response to sender sending something) so do I need to take care of sender window. how to find that sender window. is it same as tcp window?
    – user786
    Dec 30, 2021 at 13:18
  • Considering both received SYN and sent SYNACK, one can see, that sequence number in SYN is 15 1a 68 41 and ACK number in SYNACK is also 15 1a 68 41, which is not SYN + 1 as it should be. so if I am filling my SYN+ACK packet's acknowlegement number like this tcp->ack_seq=htons(ntohs(tcph->seq)+1); is this correct? but with this my received sequence number is not incrementing to seq+1 before getting assigned to send SYN ACK's acknowledgement number in my code which u showed in your answer wireshark
    – user786
    Dec 30, 2021 at 13:28
  • no, receiver takes care of receiver window. However, receiver needs to send a correct ACK, so that the sender can figure out which packet this ACK refers to.
    – Effie
    Dec 30, 2021 at 13:28
  • tcp->ack_seq=htons(ntohs(tcph->seq)+1); should be correct. However, as I pointed out in our discussion to your previous question you had called a function "fill_some_tcp" (or something like this) 3 times, and changed the values of the headers in between calls. Look at your code and check if you overwrite this tcp->ack_seq value.
    – Effie
    Dec 30, 2021 at 13:30
  • tcp->ack_seq=htons(ntohs(tcph->seq)+1); should be correct. yes I know or at least sounds like but I am not getting it right because this may be wrong it looks correct but there is something inherently wrong with tcp->ack_seq=htons(ntohs(tcph->seq)+1); it may be byte-ordering playing their magic or something, it really driving me nuts :< see this question stackoverflow.com/questions/70540996/…
    – user786
    Dec 31, 2021 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.