Reset
TCP RST (Reset, bit 5) abruptly terminates a TCP connection. Unlike FIN which closes gracefully, RST immediately discards all buffered data and closes the connection without acknowledgment. RST is sent when a packet arrives for a non-existent connection, after a connection error, or when an application calls close with SO_LINGER=0.
Abbreviation
RST
Bit Position
5
tcpdump
[R]
Standard
RFC 9293
Description
RST is TCP's emergency disconnect. It signals that the connection should be immediately aborted. The receiver closes the connection without processing any buffered data, and neither side sends further data. There is no acknowledgment of a RST – it is not reliable.
Common triggers: a packet arrives for a TCP port with no listener (the OS sends RST), an application aborts a connection by setting SO_LINGER with l_linger=0 and calling close(), a half-open connection is detected (one side crashed without sending FIN), or a firewall drops packets causing the TCP state machine to detect an inconsistency.
RST vs FIN: FIN is a graceful close – it means the sender has finished sending but the other side can still send. RST is an abort – immediately close regardless of pending data. Wireshark shows [R] for RST and [F] for FIN. A high rate of RSTs from a server indicates connection handling bugs, half-open connection floods, or port scanning activity.
Key Flag Combinations
| Flags | Meaning |
|---|---|
| RST | Abort – no connection exists for this packet (port unreachable or invalid sequence) |
| RST+ACK | Abort – acknowledging data while aborting (connection exists but is being reset) |
When You See This Flag
- –Packet arrived for a TCP port with no listener – OS sends RST
- –Half-open connection: one side crashed, other side sent data
- –SO_LINGER with l_linger=0 – application forced immediate close
- –Firewall injecting RST to terminate connections
- –NAT table entry expired while connection was idle
- –TCP sequence number outside the acceptable window