How many cases that TCP RST segment is sending out to peer over socket?

Question

I know that when a process crashed, existing TCP socket would be abandoned by sending RST packet(segment) to other peer, and relevant socket fd on other peer would receive the RST packet.

Is there other cases that RST packet sent out? Such as if a process call close() on a socket fd but with unread data left on that socket, would it also send RST packet(segment) over that socket fd to other peer?

Answer 1

Quoting the TCP/IP Guide

Generally speaking, a reset is generated whenever something happens that is “unexpected” by the TCP software. Some of the most common specific cases in which a reset is generated include:

• Receipt of any TCP segment from any device with which the device receiving the segment does not currently have a connection (other than a SYN requesting a new connection.)

• Receipt of a message with an invalid or incorrect Sequence Number or Acknowledgment Number field, indicating the message may belong to a prior connection or is spurious in some other way.

• Receipt of a SYN message on a port where there is no process listening for connections.

If you observe strange RST behaviours you may be the victim of a TCP Reset Attack

About your last question, i guess no RST is sent out when you close a socket with unread data into socket buffer because it will not break any TCP rule (packets were delivered correctly, it's just the process who didn't elaborate it). Instead a FIN will be sent.