Too Many TCP Resets

So, recently we enforced some firewall rules on a new environment, we did testing of the environment and everything was working as expected. In about 24 hours a lot of traffic from the web infrastructure was being denied and it continued, at first glance it looked like return traffic was being dropped, the web servers were sourcing at port 443 and the destination ports were using dynamic ports (RFC 6335)

No user or application problems were reported when we enforced rules, and we waited additional days to see if anything came up. Nothing came up, the only thing was a spike in amount of syslog messages of dropped traffic coming from the web servers. So from that point it really wasn’t an issue, but I thought it would be interesting to see what was going on. Continue reading

Advertisements

Understanding TCP

This tutorial is going to be talking about the TCP protocol. Every time you connect to a website you are using the HTTP protocol, but below that you are also using a TCP protocol. The nature of TCP is to provide error recovery; there are other services or applications that use TCP. HTTP however is a common protocol that is used in online applications.  Continue reading