Invalid TCP RST

Hi Stuart,

Do you still get the error messages?

Hi E.Zwep,

Still happening. Doesn't appear to have lessened at all to be honest.

Hi,

we tried to summarize some information in a KBA: https://community.sophos.com/kb/en-us/131754

Cheers

What would be the implication of just turning the logging for this off like it was pre-v16?  

Hi Bill,

the trouble is once the cat is out of the bag it is hard to put back. I see my mac book pro is trying and failing to talk to a microsoft site and I do not understand why?

I do not have an MS products active on my MBP, the only application it MS RDP so why so many failed connections? I did turn the feature off, but that still did not help with the issue raised as per the log entries.

Ian

Hi,

in my point of view: The clients already "talked" to the server. 

The KBA is to explain, why this drops happen. But the Communication already happen. 

Like mention in the KBA, you are able to deactivate the Invalid Traffic drops. 

Ian would recommend you to check your reports regarding the IP from Microsoft. There should be couple of kb/mb/gb transferred to this server. 

Cheers

Hi,

as far as I can tell and I have explored the reports extensively there is no way to tie a user to a download or download site. The reports show total download for that site/url and total download for a user and the two totals are unrelated. If you think I am wrong please point me at the correct report?

Ian

Update:- a lot more poking of various screen entries and I found the information, 78KB.

same problem here.

This situation appears with a " big" download within the 2 minutes...

So conntrack seems to be not responsible of this.

Firmware : SFV2C4 (SFOS 17.0.3 MR-3)

With different APACHE source for download, this seems to have not the same behaviour.

Will try with the newest firmware.

This is a big issue.  I have a remote VMWARE 6.5 setup that I have connected through VPN with no NAT being used.  I can not upload to the Datastores.  I can get on a workstation local to the network and everything works but nothing through the VPN connection.  I started looking through the Firewall and I see a bunch on Denies with this error message on my VPN rule.  This is a bigger problem.

Hi,

you have another issue. Please open a thread in our comunity with all information. 

The invalid TCP RST pakets is just a drop - the client already sent a RST to the server. So the Interrupt already happened. 

I got this morning these alerts, TCP RST, for a software that sync. My analysis is this is true the communication is done between the client and the server, I can see on the server sync appear, but this is true also the user client gets many messages of errors as such : you cannot authenticate with these credentials. Obviously those credentials are good. So if the interrupt already happened and is done the message seems to continue and panicked the user.

I got this morning these alerts, TCP RST, for a software that sync. My analysis is this is true the communication is done between the client and the server, I can see on the server sync appear, but this is true also the user client gets many messages of errors as such : you cannot authenticate with these credentials. Obviously those credentials are good. So if the interrupt already happened and is done the message seems to continue and panicked the user.

But seems not to be related to the issue isn´t it? 

Currently - to be honest - i never could observe an issue related to Invalid TCP RST. This alerts are just indicators for an other issue.

I haven't seen that error for a while. I'm running latest XG.

Paul Jr