[ NNSquad ] Re: How do I detect connection disruption by my IAP?

["Robb Topolski" <robb@funchords.com>]

> Behalf Of Fred Reimer
> But if all you want to do is see if 
> your ISP is deploying a forging attack against your 
> particular application you can use WireShark or some other 
> packet capture device to see if you are getting a RST after 
> your SYN.  

Be careful.  Receiving an RST after your SYN is simply "Connection Refused"
and so it may not be suspicious at all.  

It's more suspicious if you receive an RST in the middle of a
well-established connection where data is actively being exchanged.  In my
case (with Comcast), the RST abuse comes at a very specific moment during
either the handshake or after the remote client makes a data request.