Repeated DUP ACK and RST to same TCP SEQ and ACK

Question

I started noticing this behaviour for more than a month. Whenever I connect my laptop to the WiFi router there are lots of RST and DUP ACKs up to the same TCP sequence, as given in the example below, where DUP ACK reached the sequence number 13396:

13398 TCP: [TCP Dup ACK 13396#1] 52466 → http(80) [ACK] Seq=89 Ack=150 Win=42496 Len=0 TSval=3987396358 TSecr=1582119264 

576 TCP: 37734 → http(80) [RST] Seq=89 Win=0 Len=0

1074 TCP: http(80) → 37740 [RST] Seq=150 Win=0 Len=0

I don't remember where, but somewhere I read that this First Seq=89 Ack=150 and then another packet Seq= earlier ACK are TCP attacks. I am a layman to networking.

What is happening here? How do I prevent this assumed TCP attack?

Answer 1

This is not an attack, it's expected behavior.

Let's say you are connected to NetworkA somewhere, browsing the internet, and you put your computer to sleep. There are dozens (or hundreds) of network connections established, sending and receiving data. When you put the computer to sleep, they are left hanging.

When you connect to Network B, those connections are resumed, and they resume sending data.On NetworkA the public IP could be 200.100.50.25, and on NetworkB it could be 100.200.30.50. The sites you were connected to have heard of 200.100.50.25, but never heard of 100.200.30.50. In this cases, the destination will send you a RST packet, and that's what you are receiving.

This was the case back when dial-up connections were the norm and people had firewalls. Just after connecting your firewall would display lots of "attack detected" messages that were just left-over traffic from the previous "owner" of the IP.