rsync gets through the 3-packet handshake, and then about 20 packets
ending thusly:
11:34:52.749962 IP 192.168.1.73.42138 > 139.162.192.198.rsync: Flags [.], ack 32, win 502, options [nop,nop,TS val 3218474733 ecr 1658500094], length 0
11:34:52.750309 IP 192.168.1.73.42138 > 139.162.192.198.rsync: Flags [P.], seq 79:87, ack 32, win 502, options [nop,nop,TS val 3218474733 ecr 1658500094], length 8
11:34:52.851104 IP 139.162.192.198.rsync > 192.168.1.73.42138: Flags [.], ack 87, win 227, options [nop,nop,TS val 1658500119 ecr 3218474733], length 0
11:34:53.162604 IP 139.162.192.198.rsync > 192.168.1.73.42138: Flags [R.], seq 32, ack 87, win 227, options [nop,nop,TS val 1658500197 ecr 3218474733], length 0
The far end tosses an ACK for the packet, and then an ACK/RST rather than a FIN.
Rather anti-social - usually indicative of the daemon at the far end crashing and
closing the socket.
(Side note - is it me, or does the rsync dissector for wireshark do a less than optimal job?)
(And yes, I know for a fact that my router doesn't bork rsync, as it works
for other stuff on a regular basis..)