3

I am studying about TCP reset attack. I know that some RST packets have an acknowledgement number (with the ACK bit set), and some RST packets do not have an acknowledgement number (the acknowledgement number is set to 0, and the ACK bit is not set).

Now if someone were to send a forged RST packet, is there a situation where it is necessary for the RST packet to have an acknowledgement number, or will an RST packet without the acknowledgement number always work?

Improve this question

1 Answer 1

Reset to default
0

Yes, you totally need the sequence number. The sequence numbers are used throughout the entire connection. Among other things, requiring a sequence number with a reset prevents people from spoofing tcp packets with a reset flag to close long running connections (like a connection to a database server).

Improve this answer
3
  • If you have a linux machine sitting around, try installing a utility called hping3. It's a fairly simple tool for creating any kind of packet you feel like.
    – Some Linux Nerd
    Commented Mar 18, 2016 at 23:53
  • 2
    I was asking about the acknowledgement number!
    – user572563
    Commented Mar 19, 2016 at 0:07
  • Whoops! Found your answer online, packetlife.net/blog/2010/jun/7/… "The client sends its final sequence number of 727, and acknowledges the server's FIN packet by incrementing the acknowledgement number by 1 to 22952." - I gather from the link that the seq number is the server only, the ack # is just the other side of the same process?
    – Some Linux Nerd
    Commented Mar 21, 2016 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .