An analysis of TCP reset behaviour on the internet
- 1 January 2005
- journal article
- Published by Association for Computing Machinery (ACM) in ACM SIGCOMM Computer Communication Review
- Vol. 35 (1) , 37-44
- https://doi.org/10.1145/1052812.1052823
Abstract
This paper presents a one-year study of Internet packet traffic from a large campus network, showing that 15-25% of TCP connections have at least one TCP RST (reset). Similar results have also been observed from measurements of other Internet links. The results in this paper show that reset connections arise from local events such as network outages, attacks, or reconfigurations, as well as from global trends in TCP usage. In particular, we identify application-level Web behaviour as the primary contributor to the global trend in reset TCP connections. The most prevalent anomaly is the absence of the normal connection termination handshake. Instead, connections are often reset by the client. We believe that particular implementations of HTTP/TCP connection management cause this global trend.Keywords
This publication has 8 references indexed in Scilit:
- Packet-level traffic measurements from the sprint IP backboneIEEE Network, 2003
- Inappropriate TCP Resets Considered HarmfulPublished by RFC Editor ,2002
- Internet traffic measurementIEEE Internet Computing, 2001
- Critical path analysis of TCP transactionsPublished by Association for Computing Machinery (ACM) ,2000
- The TIME-WAIT state in TCP and its effect on busy serversPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1999
- Wide-area Internet traffic patterns and characteristicsIEEE Network, 1997
- Empirically derived analytic models of wide-area TCP connectionsIEEE/ACM Transactions on Networking, 1994
- Transmission Control ProtocolPublished by RFC Editor ,1981