Injects TCP resets for matching connections. By default this is a packet-level reset by IP/port (incoming and outgoing). Enable 'Reset at L7 by hostname' to instead reset connections to a named dependency selected by TLS SNI / HTTP Host, which also works over HTTPS and for shared/rotating IPs.
Injects TCP resets for matching connections. By default this is a packet-level reset by IP/port (incoming and outgoing). Enable 'Reset at L7 by hostname' to instead reset connections to a named dependency selected by TLS SNI / HTTP Host, which also works over HTTPS and for shared/rotating IPs.
Injects TCP resets for matching connections. By default this is a packet-level reset by IP/port (incoming and outgoing). Enable 'Reset at L7 by hostname' to instead reset connections to a named dependency selected by TLS SNI / HTTP Host, which also works over HTTPS and for shared/rotating IPs.
Injects TCP resets for matching connections. By default this is a packet-level reset by IP/port (incoming and outgoing). Enable 'Reset at L7 by hostname' to instead reset connections to a named dependency selected by TLS SNI / HTTP Host, which also works over HTTPS and for shared/rotating IPs.
Actively terminates matching TCP connections on the host by sending TCP RST responses. Unlike "Block Traffic", which silently drops packets causing timeouts, this attack causes immediate connection errors on the client side.
Prerequisites
If you are not using our container images for the extension, the attack requires iptables (from the iptables package).
Details
The attack uses iptables REJECT rules with --reject-with tcp-reset to send TCP RST packets for matching connections. This affects both incoming and outgoing TCP traffic. The iptables rules are inserted at the top of the host's filter chains to ensure they are evaluated before any existing rules (e.g., Kubernetes kube-proxy rules). Each attack instance creates a unique iptables chain, allowing multiple concurrent attacks with different filters on the same target.
Only TCP traffic is affected. UDP and other protocols are not impacted by this attack.
L7 mode: reset by hostname (SNI / HTTP Host)
Enabling Reset at L7 by hostname (SNI/Host) switches this attack from the packet-level engine to the transparent proxy, so it resets connections to a named dependency instead of by IP/port. The default (checkbox off) keeps the historical packet-level behaviour described above.
Default (packet-level)
L7 mode
Selects by
IP / port
hostname (TLS SNI / HTTP Host)
Direction
incoming and outgoing
outgoing only
HTTPS / shared or rotating IPs
only if you know the IPs
matched by hostname, works over HTTPS
Percentage
—
supported
Statistics
—
per-hostname matched/faulted widget
In L7 mode the Hostnames parameter is required (it selects the dependency), Percentage applies, and Include Ports defaults to 80,443 when left empty. Exclude Hostnames and Network Interface apply to packet-level mode only.
Protocol compatibility (L7 mode)
HTTP/1.x cleartext — matched by the HTTP Host header.
HTTPS (TLS), HTTP/1.1 and HTTP/2 over TLS — matched by the TLS SNI (the reset acts at the connection level).
HTTP/2 cleartext (h2c) — not matched.
HTTP/3 (QUIC) — not affected: the proxy intercepts TCP only.
Statistics (L7 mode)
A Dependency Fault Statistics widget shows connections matched and reset, plus a per-hostname breakdown. A matched count of zero means the interception installed but no traffic hit it.
Use Cases
Simulate abrupt connection resets from upstream or downstream services
Test client-side retry and reconnection logic under immediate connection failures
Verify circuit breaker behavior when connections are actively refused rather than timing out
Simulate firewall or load balancer dropping connections with RST
Parameters
Parameter
Description
Default
Duration
How long should TCP connections be reset?
30s
Include Hostnames
(optional) Restrict to/from which hosts the traffic is affected.
Include IPs/CIDRs
(optional) Restrict to/from which IP addresses or blocks the traffic is affected.
Exclude Hostnames
(optional) Exclude traffic to/from these hosts from being affected. Excludes always take precedence over the include restrictions.
Exclude IPs/CIDRs
(optional) Exclude traffic to/from these IP addresses or CIDR blocks from being affected. Excludes always take precedence over the include restrictions.
Include Ports
(optional) Restrict to/from which ports the traffic is affected
Network Interface
(optional) Target network interface to affect. All non-loopback if none specified
Attack
Go back to list
