I've been fighting off a weird issue we've been having in our internal network: from time to time, multiple applications that we use simply freeze: SQL Management Studio, Red-Gate's Data Compare, Citrix GOTOMeeting and so forth.
I decided to get a trace of the network using Wireshark. I noticed just before things "froze", I found a MASSIVE number of RST packets being sent FROM our clients to the destinations, at the same time.
We're talking 37 RST packets at the same time (obviously milliseconds apart) to different destinations. Notice the RST packets are not being sent due to a failed 3-way handshake ... it is randomly being sent.
What could be the cause? What should I be trying to test? Thank you.
This is a response to a port scan. RST+ACK is a response to a SYN when the port is not being listened to. Your computers are generating this, for a wide variety of ports. Presumably, you're not listening on that wide variety of ports, so you respond to each connection attempt with a RST+ACK.