There are a two common ways that a TCP connection can be torn down. The polite way (FIN) and the (Reset). Tearing down TCP connections is a good thing as long as it is not actively in use, or won’t be needed in the very near future. We want each side of the conversation to open up the resources for other connections rather than maintaining idle ones in an active state.
In most cases, we want to see FINs tear down a connection rather than resets. However there are some examples of normal behavior where a reset is sent rather than a FIN.
f a RST happens abruptly, mid-stream in a TCP connection, this is something to worry about. Likely, the user experienced an application disconnect, or had a problem starting the app in the first place. These can be a result of a load-balancer, firewall, or router in the middle that is timing the connection out prematurely, or can be an application problem on the server side. Clients can also generate these on-demand by stopping a page from loading manually - depending on the browser used.
If the TCP RST is sent right after the SYN, it could mean the port is not open.
Hope that helps.
Azam
