flags RP in capture

[jayesh.thakur]

below is the attachment what we see in the capture

need to know what does the flag RP mean

thanks

jayesh

9:09:06.570862 6d3d.55cd.1508 00a0.2432.1051 0x0800 62: 172.29.2.1.4367 > 10.20

.30.30.1100: S [tcp sum ok] 1164633213:1164633213(0) win 64512 <mss 1260,nop,nop

,sackOK> (DF) (ttl 126, id 50532)

19:09:06.573182 00d0.03a6.980a 0011.2040.26d3 0x0800 60: 10.20.30.30.1100 > 172.

29.2.1.4367: RP [tcp sum ok] 3563811794:3563811794(0) ack 1164633214 win 0 (ttl

62, id 5477)

19:09:09.487584 cc04.e341.6fd8 00a0.2432.1051 0x0800 62: 172.29.2.1.4367 > 10.20

.30.30.1100: S [tcp sum ok] 1164633213:1164633213(0) win 64512 <mss 1260,nop,nop

,sackOK> (DF) (ttl 126, id 50548)

19:09:09.488240 0006.d679.fc0a 0011.2040.26d3 0x0800 60: 10.20.30.30.1100 > 172.

29.2.1.4367: RP [tcp sum ok] 3563811794:3563811794(0) ack 1164633214 win 0 (ttl

62, id 5478)

19:09:15.496357 be88.0af6.1b9c 00a0.2432.1051 0x0800 62: 172.29.2.1.4367 > 10.20

.30.30.1100: S [tcp sum ok] 1164633213:1164633213(0) win 64512 <mss 1260,nop,nop

,sackOK> (DF) (ttl 126, id 50576)

19:09:15.497487 00d0.03a6.980a 0011.2040.26d3 0x0800 60: 10.20.30.30.1100 > 172.

29.2.1.4367: RP [tcp sum ok] 3563811794:3563811794(0) ack 1164633214 win 0 (ttl

62, id 5479)

[gfullage]

R = RST, P = PSH bits, additionally S = SYN and A = ACK bits.

In this output 172.29.2.1 is attempting to connect to TCP port 1100 on 10.20.30.30 (by sending a TCP SYN), but this host does not seem to be listening on that port so it sends back an RST straight away.

Strange that the PSH bit would be set also, you don't normally see that in an RST packet, but it all depends on the TCP stack of the device.

[jayesh.thakur]

thanks,

but the port is open as it works on the lan it is only via the ipsec tunnel that we get the error.