Connection was forcibly closed by TPC RST packet from Microsoft servers

From Your Packet Trace

Lines 415–423:

SharePoint IP → Client IP TCP 60 443 → Random Port [RST]

These lines show that Microsoft’s SharePoint server is sending TCP RST (Reset) packets to your client after a successful TLS handshake. This means:

• The connection was established and encrypted.
• Application data may have started flowing.
• But the server forcefully terminated the connection before any HTTP-level response (like 200 OK or 429 Too Many Requests) was sent.

Possible Causes

TCP RST After TLS Handshake
Indicates a low-level network termination.
No HTTP response is generated, so your app sees a SocketException (10054).
IP-Based Throttling or Filtering

Microsoft may block or throttle traffic from IPs that:
Exceed request limits.
Are flagged for suspicious activity.
Belong to shared hosting environments.

Connection-Level Filtering
Firewalls or load balancers may drop connections based on:
TLS fingerprint mismatches.
User-Agent headers.
Request frequency or burst patterns.

Remediation (Best Practices)

Implement Robust Retry Logic
Catch IOException and SocketException.
Respect any Retry-After headers if available.

Use Microsoft Graph API

More stable and better supported than direct SharePoint REST endpoints.
Handles throttling and retries more gracefully.

Contact Microsoft Support to confirm the throttle issue.