Finding out the cause for a connection reset

retag add tags

I have connections on several ports that are being "forcefully closed".

In Wireshark I see these connections in red background with yellow text color.

How can I find the reason?

These are all connections for 127.0.0.1 so I don't believe a firewall is involved.

I believe there is some software closing it and I want to find out which one.

Wireshark cannot tell you why the RST was transmitted, that will be down to the OS or application using the socket. The usual cause is that the socket has been closed.

Note that a RST isn't necessarily bad, it is (mis)used as a fast way of closing a connection.

23.8k

grahamb

answered 2020-07-11 18:01:47 +0000, updated 2020-07-11 18:02:20 +0000

edit flag offensive 0 remove flag delete link

Comments

Well, I do have a problem with someone closing connections to some ports all the time.

So how can I find out who is doing that?

SectionOne (2020-07-12 08:31:06 +0000) edit

How do you know there's a problem? Is an application misbehaving or reporting errors?

grahamb (2020-07-13 10:00:32 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Finding out the cause for a connection reset edit

Comments

1 Answer

Comments