ASA Reset-I syslog but reset is from Outside?

[brettp]

I was troubleshooting an issue for someone here... Ultimately, I did find the problem, but in the process I uncovered something strange. Can anyone explain to me why the syslog says "Reset-I" but the RST is coming from the outside (as evidence by the wireshark capture.) Shouldn't it say "Reset-O?" Any insight is appreciated. Thanks!

[Dennis Mink]

the first line in your asa log screenshot shows rst on inside interface. from 192.x   what direction is this traffic going? is the SYN from inside to outside?

[brettp]

Thank you for the reply. The time increments as you go up the syslog list (unless since it’s the same timestamp for everything, that doesn’t apply?) oo that inside RST is after the outside RST) The line that’s selected (highlighted in blue) is the RST in question. The initial connection was created from inside (192.168.112.81) out to a host on the internet. Also, in the wireshark capture, you can see the RST is coming from the host on the internet, not the inside host.