0

Why the server(i.e modbus tcp slave) answer RST right after receiving SYN from the client?

Here are the packets captured by Wireshark:

  1 09:58:55.773863730 192.168.0.168         192.168.0.21          TCP      66     39110 → 502 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128
  2 09:58:55.774090423 192.168.0.21          192.168.0.168         TCP      60     502 → 39110 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
  3 09:58:55.774194303 192.168.0.168         192.168.0.21          TCP      66     39112 → 502 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128
  4 09:58:55.774298582 192.168.0.21          192.168.0.168         TCP      60     502 → 39112 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
  5 10:01:35.548023265 192.168.0.168         192.168.0.21          TCP      66     39118 → 502 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128
  6 10:01:35.548248696 192.168.0.21          192.168.0.168         TCP      60     502 → 39118 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
  7 10:01:35.548340993 192.168.0.168         192.168.0.21          TCP      66     39120 → 502 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128
  8 10:01:35.548446706 192.168.0.21          192.168.0.168         TCP      60     502 → 39120 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
  9 10:02:09.279784987 192.168.0.168         192.168.0.21          TCP      66     39126 → 502 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128
 10 10:02:09.279974571 192.168.0.21          192.168.0.168         TCP      60     502 → 39126 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
 11 10:02:09.280092319 192.168.0.168         192.168.0.21          TCP      66     39128 → 502 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128
 12 10:02:09.280196486 192.168.0.21          192.168.0.168         TCP      60     502 → 39128 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

Update: The server really listens to the port. I confirm that by netstat -atn | grip 502( and returns tcp 0 0 0.0.0.0:502 0.0.0.0:* LISTEN ) on the server side.

And telnet 192.168.0.21 502 returns Connected to 192.168.02.21.

John
  • 2,963
  • 11
  • 33
  • 1
    Because nothing was listening at that IP:port. This is a 'connection refused'. – user207421 Apr 01 '21 at 03:39
  • @user207421 The server really listens to the port.I confirm that by `netstat -atn | grip 502`( and returns `tcp 0 0 0.0.0.0:502 0.0.0.0:* LISTEN `) on the server side. And `telnet 192.168.0.21 502` returns `Connected to 192.168.02.21`. – John Apr 01 '21 at 06:12

0 Answers0