Invalid tcp handshake behaviour

28 views
Skip to first unread message

lira...@gmail.com

unread,
Feb 17, 2020, 4:24:33 PM2/17/20
to Pcap.Net Q&A

Hello, I need some help. I'm using pcap.net for sending a tcp raw packet inside a LAN with some payload data. In order to be able to send the packet I need to perform a tcp handshake before sending a payload. 

I verified that no firewall is active on both endpoints. Also, use netstat -a / nmap scan to verify that the used ports are in "listening" state. Details for the endpoints:


source ip - 10.0.0.7
source port - 2869
destination ip - 10.0.0.11
destination port - 5357


When sending a syn from 10.0.0.7, it can be seen that 10.0.0.11 responds with SYN-ACK. However, 10.0.0.7 Instead of sending ACK it sends RST.

As I understand from wireshark documentation, RST means that a connection reset has send. 


This kind of behavior always occur and I don't know it the tcp handshake is valid. 

I need your help.


wireshark export file: 

https://drive.google.com/file/d/1zrZXWmpNLEBUw3SwOfl0jHBIWkknH9ZB/view

image:

https://drive.google.com/file/d/1pso_RvHqiHIExfVIMsYzp5vC5YXiMD9e/view

Thank you

Reply all
Reply to author
Forward
0 new messages