Reset은 어디서 오는 것일까? (황새가 물어다 주지 않습니다)

Networking ? ??? ??? ?? ?? network capture?? TCP Reset frame? ????? ?? ?? ??? network? ??? ??? ?? ??? ???? ??? ?? ???. ??? ?? TCP reset? ??? ??? ?? ?? ????. TCP Reset frame? ??? ??? ??? ???? ??? ? ?? ??? ??? ??? ??? ?? ????..

??? reset? ???? ????. Reset? ??? ????? ?? open?? connection? ??? ? ????. ?? ?? ?? ??????? ?? ??? TCP connection? ?? ??? server ????? ? connection?? Time Wait state ?? ???? ??? ???? application? ? connection? reset?? ???. ?? ?? ??? ? ?? ???? ?????.

The Three Way Handshake

?? TCP connection? ???? ?? ????? ?????. ????? ? ??? ?? ????? ?? ??? TCP? ??? ?? ????, TCP connection? establish?? ???. ??? ?? ??? ??? ?????? ???? Syn frame(???: Synchronization)? ?? ??? ?? ??? ??? ???. ? packet?? connection? establish?? data? ????? ??? ?? ???? ???? ????. ??? ??? ?? ???? ?? port ?????. Connection? ??? ?????? source port? ??? destination port ??? ??? ???. ? Syn frame? ???? Source Port? ??? ?? ??? connection? establish? ?? ??? Destination port ??? ??? ????.

?? frame? Syn packet? ?????. TCP:Flags= .......S ??? ?? Syn frame?? ? ? ????. SrcPort? Source Port? ???? ?????? connection? establish? ? ??? port???. DstPort? Destination Port? ???? ? ???? 445?? Direct SMB port???. ??? Syn packet? ???? ?? ??? ?? ??? ? ??? ?? port? listening?? ??? ???.

Connection establishment? ?? ? frame?? ?????. ??? frame? Ack, Syn frame???. ??? ??? Syn frame? ??? ???? Acknowledging(??)? ?? ???? Syn frame? ????. ??? ??? ?? frame?? ?? ???. Source? Destination port? ??? ??? source? ?? ?????? destination? ?? ??? ??? ?? ?? ???? ? ? ????.

??? ack? client?? ??? ?? Syn frame? ????Acknowledging(??)? ?? ??? connection establishment? ?????? ?? ?????.

Connection establish ??? ????? Three Way Handshake? ??? ????. ?? ? ?? ?? port set? ??? connection? ?? ??? ?? ?????.

Time Wait state

?? ??? Time Wait state? ??? ?? ???? ??? ?? ???? ? ??????

TCP connection? ???? gracefully(???)?? ????? Fin frame? ??? ???. ?? ? ????? ??? ???? ??? ?? ?????. ??? ??? ? frame? ??? Ack? ?? ?? ? ?? ??? ???? ??? ???? ??? ???? Fin? ??? ?? ??? ????? Ack?? ???.

Fin frame? ?? ???? ?? ????? ?? ??? Fin? ?? Ack? ?? ???. ? ??? TCP connection? Time Wait state? ???? ???. ? connection? ???? 4? ??? time wait ??? ?????. ?? ? connection? ???? ??? packet? ?? ??? ?? ??? ????? ? ???? connection? ??? ? ?? ???.

?? TCP connection? ??? establish?? ????? close??? ?? ?????. ?? ??? ??? ? TCP connection? reset?? ??? ????? ?????.

Resets

Reset? ?????? TCP reset? TCP connection? ?? ?? ????. ?? ??? ?? connection? ?? ??? ??? ???? ???? ?? ???? ??? ???.

SMB Reset

SMB Reset? TCP Reset?? ??? ? ??? ?????. ? ??? network traffic? ?? ????? ??? ?? ??? TCP Reset? ?? ?? ???? ???? ?????? ?? ?? ???? ?????. ??? ??? ??? ??? ????.

Windows 2000?? ????? 139 port? ???? ??? SMB? ?? 445 port? ????? ??????. ? ???? ?????? ??? TCP Sync packet, ??? destination port? 445? ??? ??? ??? destination port? 139? Syn packet? ??? ???. ? ??? ??? ? blog? ??? ???? ??? ?? ??? ?? ???? ???? ?? ?????. ?? ??? 139? 445 port? ?? listening?? ??? ?? ??? Ack, Syn packet? 139? 445 port ??? ??? ???? ???. ?????? ? ?? Ack packet? ???? port? ??? ?? ?? port? reset?? ???. ??? ?? ?? ?????.

Ack, Reset

???? Syn? ?? Ack Reset???. Ack Reset? Syn frame? ?? ????, frame? ???? ??(acknowledge)?? ?????. ??? ??? ??????? ?? port? connection? ??? ? ??? ?? ???? ????. Ack, Reset? ????:

1. ????? ??? ????? ?? port? listening ?? ?? ?? ??

2. ??? ??? ?? ??? ?? port? ??? ???? ?? ??. ?? ??, ??? ??? ???? connection? ????? ??? ???? ???? ??? ??.

??: ??? ?? ??? port? ??? ??? listening?? ?? ???? Ack Reset? ???? ??? ??? ?? ????. ??? Syn frame? ?? ???? ?????. ?? ??? ?? ?????.

TCP Reset due to no response

?? Reset? ?? ?? network frame? 6? ???? ??? TCP Reset???.(?? frame? ???? ? ? ?? 5?? frame retransmit? ?????) ??? ??? ???? ???? connection? reset???. ?? ??? three way handshake ??? establish? connection? ??? ??? ?? ?????. Reset???? retransmit ??? ??? ? ??? ???? 5???.

??: connection? establish??? ? Syn frame? ?? retransmit ?? ??? ???? 2???. ??? TCPMaxConnectRetransmission ????? ?? ??? ? ????.

???? ??? ???? ??? ?? ?????? ???? ?? ?????. ???? ??? ? ???? retransmit ? ?????. ??? ???? sender? frame? ??? ? frame? ??? Ack? ?? ??????. ??? TCP? ???? retransmit ???? ???? ? ???? frame? ?? Ack? ?? ??? ???. Packet? ??? retransmit??? ? sender? Ack frame? ??? ??? ???? ?????. ??? Ack? ?? ??? connect? ??? reset? ??? ???. ??? ??? ??? ????? ?? Ack? ??? ??? ??? ??? ??? ?? connection? ??? ???? ??? ?????. ??? ???? ? ???:

1. 5?? packet? ??? packet? ?????. ?? 5?? retransmit packet? ???? ?? ????. ??? packet? 5? retransmit?? ????.

2. Retransmit ??? sending node??? ???? ?? frame?? Ack? ???? ????.

3. Late Acknowledgement? ? ??? ???? ????. Late acknowledgement? Acknowledgement? ?????? Retransmit Time Out(RTO)? ???? frame? retransmit?? ?? ?? Acknowledgement? ??? ?? ?? ???.

Application Reset

? ??? ???? ?? ??? ??? ????? ????? ??process? ?? ??? ?????. ?? ???, application? ??? ??? ?? ??? reset? ?? ??? ?? ????. ??? ???? ?? ????? ? ??? ?? ????. ?? ???? network traffic? ?? ?? ? ??? ??? ??? ?? ??? ?? ??? ?? ?? TCP? ??? ????? reset? ???? ?? application? ??? ???? ????. ??? ???? ????? ?? ????? ???? ??? ????. ??? ?? ??? TCP connection? ?? ???? ??????? ???? ?????. ??? ??????? ?? Time Wait state ??? port? ???? ?? ?? ??? ??? ? ????. ??? ?????? ???? ?? connection? reset??? ??? ? Time Wait state? ????? ??? ??? ????.

Note: ??????? code? ?? Winsock function close(socket)? ????? ??? ???. ?? data? ??? connection? ??? ??? ????? Reset? ???? ???. ?? Winsock logging? ??? ? ????. ?? ? function ? ?? Three Way Handshake? ???? data? ???? ?? connection? ? ?????? Fin frame? ?? ???? connection close? ???? ???.

?? ??????(???? ?? ???) destination ??? ?? process? ? port? ???? ?? ?? ??? ? ????. ??? ??? system? ??? ? ? ??????? ??? port? ??? listening??? ? ?? ??? ? ????.

For advanced users and network Admins

“Reset? ????? ??”? B ??? ?? ???. ??? ??? ??? ? ??, ?? ???? ? reset? ????? ? ?? ???? ????? ???? ?????.

?? ?? ??? ? ??? ?? ???? ??? ?? ??? ????? ???? ??? ???? ??? connection? reset? ? ????. ?? ????? ? ??? ???? sending ??? receiving ??? source ??? destination IP address? ??? ?? ??? ?? ??? ?????. ??? ??? reset ??? ???? ??? source? destination ???? ?? trace? ???? ????. Network capture??? ? ???? ?? reset? ? packet? ?????? ???? ??? capture??? ???? ?? ?????. ??? ??? ???? ???? ??? ?? ? ?? ?? ??? ?? blog ??? ? ? ??? ??? ???? ?? ??? ?? ??? ??? ????? ????. ?? ?? ? blog??? source? destination network capture? ???? ?? ????? ??? ??? ?? ? ??? ? ??? ??? ???.

??? ???? ??? ??? ???? reset? ?????? ?? ?? ??? connection ? reset? ? ??? ????. ??? ? ???? TCP connection? setup ???? ??? ?????. Source IP 10.10.10.20, Destination IP 10.10.10.30 ??? TCP port 2301? 445 ??? connection? ????. ??? ? ? ?? ?? reset packet? 10.10.10.20 destination port 2301? ?? reset packet? 10.10.10.30 destination port 445? ?? ???? ?? ? ? ????.

Port re-use

?? ??????? Time Wait ??? port? ?????? ??? Reset? ??? ? ????. ??? ??? ?????? ??? connection? ??? graceful close ??? ??? Time Wait?? ??? ? ??? ? ????. ??? ?????? ??? port ?? ??? ?? ??? Syn frame? ??? source? destination port? ?? ? ????. RFC 1122? ?? ??? ??? ???? ????? ???? ???. ?? ???? ????? ?? Time Wait? port? ???? ??? ??? ???? ???. ???? ? ?? Syn frame? Sequence ???? ?? connection? ???? ??? connection? establish?? frame? ?? connection? ??? frame? sequence ???? ??? ?? ???. ?? ??? ??? reset? ??? ? ????.

In Summary

TCP Reset? ???? ????. ??? ???? TCP reset? ??? ?????? TCP? connectivity ??? ????? ? ?? ??? ??? ? ????. Reset? network stack?? application ???? ??? ???? ?????. ?? retransmit packet? ??? connection ? reset? ???? ?????? ????. Frame? ???? ? retransmit? ????? ???? ?? ?????.

- Clark Satter