The above 7 packets looks like this in text export. The client sends another RST packet (without ACK) this time with the SEQ # 1 bytes more than that in 3.The server sends another ACK packet which is the same as 4.above (i.e 138 bytes ahead of what server is expecting) At this point in time, the client sends a RST, ACK with the SEQ # of 2.The server respond to this Keepalive packet (Wireshark marks as DUP ACK).About 1 second later the client sends another ACK packet this time round it looks like a Keepalive (because the SEQ # is one less than what server expects).The client sends back an ACK but with its own (client's) SEQ # about 138 bytes ahead of what the server expected so Wireshark marks this as previous segment not captured.The server sends some data (100 bytes) to the client,.

Then suddently the following happens and the client sends two RST packet as follows: Towards the end of the 9 hrs, there is little data and I can see the client sends keepalive packets now and then at intervals of about 1 second. I have a client which has TCP connection was established to a server for some 9 hr plus and was able to remain connected without any issues. And why the client sends two RST packet out of the blue. I need someone to help me interpret what is going on with the tcpdump I have - this is taken on the server end.

Wireshark display filter rst