Introduction

Actively terminates matching TCP connections by sending TCP RST responses. Unlike "Block Traffic", which silently drops packets causing timeouts, this attack causes immediate connection errors on the client side.

Details

Note: If you are going to attack containers using network attacks, all containers in the target's linux network namespace (e.g. all containers belonging to the same Kubernetes Pod) will be affected. In case you want to target the traffic of a single container in the namespace you can for example use the port parameter to limit the blast radius.

The attack uses iptables REJECT rules with --reject-with tcp-reset to send TCP RST packets for matching connections. This affects both incoming and outgoing TCP traffic. The iptables rules are appended to the container's network namespace filter chains. Each attack instance creates a unique iptables chain, allowing multiple concurrent attacks with different filters on the same target.

When an Istio sidecar is detected in the target's network namespace, the attack automatically uses a mark-based approach: matching packets are marked in the mangle table (before Istio's NAT rules rewrite the destination) and then rejected in the filter table based on the mark. This ensures the attack works correctly even when Istio redirects traffic through its Envoy proxy.

Only TCP traffic is affected. UDP and other protocols are not impacted by this attack.

L7 mode: reset by hostname (SNI / HTTP Host)

Enabling Reset at L7 by hostname (SNI/Host) switches this attack from the packet-level engine to the transparent proxy, so it resets connections to a named dependency instead of by IP/port. The default (checkbox off) keeps the historical packet-level behaviour described above.

In L7 mode the Hostnames parameter is required (it selects the dependency), Percentage applies, and Include Ports defaults to 80,443 when left empty. Exclude Hostnames and Network Interface apply to packet-level mode only.

Protocol compatibility (L7 mode)

• HTTP/1.x cleartext — matched by the HTTP Host header.
• HTTPS (TLS), HTTP/1.1 and HTTP/2 over TLS — matched by the TLS SNI (the reset acts at the connection level).
• HTTP/2 cleartext (h2c) — not matched.
• HTTP/3 (QUIC) — not affected: the proxy intercepts TCP only.

Statistics (L7 mode)

A Dependency Fault Statistics widget shows connections matched and reset, plus a per-hostname breakdown. A matched count of zero means the interception installed but no traffic hit it.

Use Cases

• Simulate abrupt connection resets from upstream or downstream services
• Test client-side retry and reconnection logic under immediate connection failures
• Verify circuit breaker behavior when connections are actively refused rather than timing out
• Simulate firewall or load balancer dropping connections with RST

Parameters