Counts TCP segments sent by this device that carry the RST, or reset, flag. On a firewall this is a meaningful security signal distinct from application-level closes; a device that actively resets connections, rather than silently dropping them, is choosing an explicit rejection, so a spike here often correlates with a specific rule or IPS action tearing down sessions rather than a passive drop policy. Example: tcpOutRsts spiking right after enabling a new IPS protection that terminates matching sessions confirms that protection is actively tearing down flagged connections with resets, not just logging them.