NNSquad - Network Neutrality Squad

NNSquad Home Page

NNSquad Mailing List Information


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ NNSquad ] Re: How do I detect connection disruption by my IAP?


> Behalf Of Fred Reimer
> But if all you want to do is see if 
> your ISP is deploying a forging attack against your 
> particular application you can use WireShark or some other 
> packet capture device to see if you are getting a RST after 
> your SYN.  

Be careful.  Receiving an RST after your SYN is simply "Connection Refused"
and so it may not be suspicious at all.  

It's more suspicious if you receive an RST in the middle of a
well-established connection where data is actively being exchanged.  In my
case (with Comcast), the RST abuse comes at a very specific moment during
either the handshake or after the remote client makes a data request.