> Hi, > > > a simple question, though I could not clearly read it from the TCP RFC... > do RST packets always have ACK set? It seems that isn't so : (http://www.knowplace.org/netfilter/ip_overview.html) Resetting a connection The four-way handshake is not the only way to tear down an established TCP connection. Sometimes, if either hosts need to tear down the connection quickly (timeout, port or host unreachable, etc.), a RST (Reset) packet is sent. Note that since a RST packet is not necessarily always part of a TCP connection, it can be sent by itself. RST packets that are part of a TCP connection is usually accompanied by the ACK flag as well. Note that RST packets are not acknowledged. Gr, Rob
