TCP Reset Injection.

An attack that forges TCP RST segments matching an existing connection so endpoints abruptly close it, breaking or hijacking the session. It belongs to the Attacks & Threats category of cybersecurity.

An attack that forges TCP RST segments matching an existing connection so endpoints abruptly close it, breaking or hijacking the session.

TCP reset injection abuses the design of TCP, where a packet bearing the RST flag and an acceptable sequence number forces both endpoints to tear down the connection. An attacker who can observe or guess the four-tuple (source/destination IP and port) and a valid window sequence number - by sniffing the link, by being on-path, or via off-path inference - can inject a spoofed RST that ends the session. The technique is used by some nation-state censors to block specific TLS handshakes, by IDS/IPS to terminate detected attacks, and by attackers wanting to disrupt streaming, BGP or SSH sessions. Defenses: encrypt sessions end-to-end (TLS, IPsec), use the TCP MD5/AO option for BGP, enable TCP timestamps and sequence-number randomization, and monitor for RST anomalies.

Defences for TCP Reset Injection typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: TCP RST attack, RST injection, Connection reset attack.