Sometimes ROS sends two TCP RST packets on connection termination

RouterOS General
1

ROS 6.7

Sometimes ROS sends two TCP reset packets when terminating connection.
why ?

I am trying to count RST on PPTP connections to detect failed PPTP attempts (no more than 3 failed attempts in 10 minutes through list address stages) to quality source address into blacklist 10 days timeout.

12:45:44 pptp,info TCP connection established from 83.4.171.231 
12:45:44 pptp,ppp,info <pptp-0>: waiting for call... 
12:45:44 pptp,ppp,info <pptp-0>: terminating... - user evl authentication failed 
12:45:44 pptp,ppp,info <pptp-0>: disconnected 
12:45:44 firewall,info PPTP Reset blacklist-out: in:(none) out:wan1, proto TCP (ACK,RST), 192.168.200.139:1723->1.2.3.4:51435, len 4012:45:51 pptp,info TCP connection established from 1.2.3.4 
12:45:51 pptp,ppp,info <pptp-0>: waiting for call... 
12:45:51 pptp,ppp,info <pptp-0>: terminating... - user evl authentication failed 
12:45:51 pptp,ppp,info <pptp-0>: disconnected 
12:45:51 firewall,info PPTP Reset blacklist-out: in:(none) out:wan1, proto TCP (ACK,RST), 192.168.200.139:1723->1.2.3.4:51436, len 40 
12:45:58 pptp,info TCP connection established from 1.2.3.4 
12:45:58 pptp,ppp,info <pptp-0>: waiting for call... 
12:45:58 pptp,ppp,info <pptp-0>: terminating... - user evl authentication failed 
12:45:58 pptp,ppp,info <pptp-0>: disconnected 
12:45:58 firewall,info PPTP Reset blacklist-out: in:(none) out:wan1, proto TCP (RST), 192.168.200.139:1723->1.2.3.4:51439, len 40 
12:45:58 firewall,info PPTP Reset blacklist-out: in:(none) out:wan1, proto TCP (RST), 192.168.200.139:1723->1.2.3.4:51439, len 40 
12:46:04 pptp,info TCP connection established from 1.2.3.4 
12:46:04 pptp,ppp,info <pptp-0>: waiting for call... 
12:46:04 pptp,ppp,info <pptp-0>: terminating... - user evl authentication failed 
12:46:04 pptp,ppp,info <pptp-0>: disconnected 
12:46:04 firewall,info PPTP Reset blacklist-out: in:(none) out:wan1, proto TCP (RST), 192.168.200.139:1723->1.2.3.4:51440, len 40 
12:46:04 firewall,info PPTP Reset blacklist-out: in:(none) out:wan1, proto TCP (RST), 192.168.200.139:1723->1.2.3.4:51440, len 40
2

The client is likely trying to send packets on an invalid connection, which results in RST for every packet. The RST is sent in response to the client, not part of the termination (which should use FIN).

3

The RST is sent in response to the client, not part of the termination (which should use FIN).
wireshark on the client reveals the pptp server is sending the RST.

4

RST should only be sent in response to an invalid packet, it’s not meant as a way to terminate a connection (although some software does do this).