Are there any requirements for the sequence numbers on TCP Reset packets?

Question

If there is a TCP connection between TCP program A and B, and its source IP address/port and destination IP address/port are known by an attacker, now the attacker wants to send a TCP Reset packet to A to end the TCP connection.

Now, let's assume that, for A, its TCP stack just sent a TCP Ack packet with sequence number 1000 and acknowledgement number 5000.

Are there any requirements for the sequence number and acknowledgement number on the Reset packet?

If the Reset packet uses seq: 5000 and ack:1000, it will definitely be accepted by the TCP stack of A and the TCP connection is ended on A.

How about the following combinations?

1 seq: 5000, ack_seq: 0
2 seq: 5000, ack_seq: 999  ( this ack_seq is obsolete, namely <1000)
3 seq: 5000, ack_seq: 1002 ( this ack_seq is proactive, namely >1000)
4 seq: 5001, ack_seq: 1000 ( the seq is not consistent)
5 seq: 5001, ack_seq: 999  ( both seq and ack_seq are not consistent)

It seems to me that 1 is ok for killing the connection?

Answer 1

In this case you have an established connection. That means combination 1 won't work.

RFC793, Page 15 states the following about the ACK number:

Acknowledgment Number: 32 bits

If the ACK control bit is set this field contains the value of the next sequence number the sender of the segment is expecting to receive. Once a connection is established this is always sent.

So you still need to send an ACK number with your RST package to terminate a connection. But this seems also true with not established connection and closed ports. If you send a SYN packet to a closed port, then the other side will responed with a RST,ACK package.

You can analyze this with wireshark.

Answer 2

As per RFC793, Page 69, when a segment arrives for a connection in a state other than LISTEN, it is at first checked whether the sequence number falls into the receiver window, and if it doesn't, it's dropped.