How to prevent .NET libraries from sending RST packet on close

c socket close vs disconnect
http connection close vs keep-alive
httpclient is shutting down messenger
c# socket example
how to prevent tcp reset attack
httpclient is shutting down facebook messenger
http server close connection
close server socket when client disconnects

I'm doing some testing trying to isolate some odd behavior in the libraries (.NET). When I use the Winsock API through C++ and simply call, closesocket(), I see the windows side send the FIN/ACK packet and the remote side send back an ACK packet. This is what I would call a graceful close. However, when programming in C# I'm not seeing what I would call a graceful close.

In C#, I open my socket and then, when closing it, I see windows send a FIN packet Only when first calling Socket.Shutdown(). However, regardless, when I call Socket.Close() in C#, an RST packet is sent and the connection summarily dropped. This confuses me because, from what I've read on line, the TCP closing process should be FIN/ACK -> ACK (from both sides actually but for now, I'm only concerned with "my" side); i.e. there should not be an RST packet in the mix at all. From what I've read, apparently, an RST packet is only sent when the receiver is uncertain about the connection state and wants out.

Why is this RST packet being sent on a planned shutdown in .NET and not at all in a planned shutdown from the winsock API? Is there a way to prevent the transmission of an RST packet during a graceful shutdown from .NET?

In case it's important, in both code paths, I'm reading all available data on the socket before calling the respective close() method.


Reading the .NET doc of Socket.Close, this is what I found:

For connection-oriented protocols, it is recommended that you call Shutdown before calling the Close method. This ensures that all data is sent and received on the connected socket before it is closed. If you need to call Close without first calling Shutdown, you can ensure that data queued for outgoing transmission will be sent by setting the DontLinger Socket option to false and specifying a non-zero time-out interval. Close will then block until this data is sent or until the specified time-out expires. If you set DontLinger to false and specify a zero time-out interval, Close releases the connection and automatically discards outgoing queued data.

which actually makes sense. If there's still data in the buffer (OS one) and you tear the connection down or kill the process the connection will be reset (more detailed information in the TCP specs).

As to when RST is sent check out TCP Guide.

My guess is that there is still some unset or in transit data or in outgoing/incomming buffers that triggers the RST.

How to properly close a Socket connection - MSDN, NET Framework Class Libraries When acquisition is to be stopped, a stop command is sent and a wait for 2 seconds, to allow any When the RST packet is sent, the other side immediately recognizes the socket is closed. Upon closer examination of the network traffic using WireShark, I found that when the connection is closed using this code, a RST packets was sometimes sent, and other times a FIN packet is sent. When the RST packet is sent, the other side immediately recognizes the socket is closed. When the FIN packet is used after Close(), it take one minute


Following code may prevent RST packet. It is because wait 60 seconds after sending a FIN packet.

socket.Close(60);

Close method description is here.

Solved: TCP-RST - J-Net Community, Solved: why do i need to enable this feature ???? will it protect me from attack or With tcp-rst on zone, it sends TCP RST packet back. What happens when after the shutdown, the peer sends packets. Stack Overflow Public questions How to prevent .NET libraries from sending RST packet on close


Just recently hit a similiar issue where an application was talking POP3 to an Exchange Server. When the .NET program finished, it closed down ungracefully, and Exchange treated the POP3 conversation as "aborted" and rolled it back.

The reason for that is I think TCP RST is a "one-way" message-- you don't have to wait for a reply. So that's what .NET sends (or perhaps any program after it terminates.) One possible solution is to wait a bit after closing the socket and before quitting the program:

Thread.Sleep(5000);

This worked for the POP3 problem I mentioned earlier; the waiting time caused the connection to shut down gracefully, and Exchange no longer aborted the session.

Protecting Against TCP RST or SYN DoS Attacks, You can use the tcp ack-rst-and-syn command to help protect the router not send another RST or SYN message and the router does not shut  I know your concern is that the server sends Reset packet instead of Finish packet to terminate the connection. You want to know if there is a way to disable any feature on windows to prevent it from sending Reset packet. However, the server's behavior is normal and it depends not on windows but on the application.


In a similar situation, I called socket.Disconnect(false) instead of socket.Close().

if (theSenderSocket != null){
    theSenderSocket.Disconnect(false);
   }

Then checking the Wireshark filters found that instead if RST/ACK, it was sending FIN/ACK.

4.7. The Mysteries of Connection Close, Any HTTP client, server, or proxy can close a TCP transport connection at any time. about to send data at the same time that the “idle” connection was being shut them to use half closes to prevent peers from getting unexpected write errors. Data arriving at closed connection generates “connection reset by peer” error. There is no RST packet anywhere. RST is used to respond to unexpected traffic, not to close a connection. For example, if you send a TCP packet to port 80, and the server is not running an HTTP server (and assuming the packet makes all the way to the server and is not blocked / ignored), then an RST reply is sent back to the client.


Programming UNIX Sockets in C, When a socket is closed, both sides agree by sending messages to each other that Second, there may be "wandering duplicates" left on the net that must be not avoid the TIME_WAIT state by setting the SO_LINGER option to send an RST Because by default, no packets are sent on the TCP connection unless there is​  In the third stream (tcp.stream eq 2), The client sends it's request, the server ACKs, but a response does not come. The client times out after 10 seconds and sends a FIN. Then the server sends a FIN back, but with a sequence number that tells us that it has been sending data before.


Computer Security and Penetration Testing, initial sequence number (ISN) A unique number for each packet on a particular A form of attack in which packets are used to send fraudulent or deceptive connection IDS technologies by adding capabilities to prevent or disallow packets from NET framework that includes a variety of reusable objects and classes that  If the connection is reset by a RST packet, the state is changed to CLOSE. This means that the connection per default have 10 seconds before the whole connection is definitely closed down. RST packets are not acknowledged in any sense, and will break the connection directly. There are also other states than the ones we have told you about so far.


Analysis of a Denial of Service Attack on TCP, Control Block structure (tcpcb) contains TCP specific in- formation such as timer tion, S will send a RST packet to D, and consequently cause. D to reset the  The Nagle algorithm is designed to reduce network traffic by causing the socket to buffer small packets and then combine and send them in one packet under certain circumstances. A TCP packet consists of 40 bytes of header plus the data being sent.