 | 1 | initial version |
The tcpdump shows the client closing the session immediately after the 3-way handshake. It did not even try to send or receive any data.
The server ignores the FIN packet and retransmits its SYN_ACK, so obviously has not seen or discarded the ACK completing the 3-way handshake. Even the following DUP_ACK seems to be ignored and the Linux server closes its socket resulting in a RSt being returned in the client's attempt to FIN the connection. . Looks like the client is not a real client but a monitor and the server is not happy accepting this 'misbehaving' client.
12.985 LxClient→ LxServr [SYN] Seq=0 Tsv=2535707980 TSe=0 WS=128
12.985 LxServr → LxClient[SYN, ACK] Seq=0 Ack=1 Tsv=1516508357 TSe=2535707980
13.183 LxClient→ LxServr [ACK] Seq=1 Ack=1 Tsv=2535708030 TSe=1516508357
13.183 LxClient→ LxServr [FIN, ACK] Seq=1 Ack=1 Tsv=2535708030 TSe=1516508357
13.682!LxClient→ LxServr [FIN, ACK] Seq=1 Ack=1 Tsv=2535708155 TSe=1516508357
13.982!LxServr → LxClient[SYN, ACK] Seq=0 Ack=1 Tsv=1516508607 TSe=2535708155
14.180!LxClient→ LxServr [ACK] Seq=2 Ack=1 Tsv=2535708279 TSe=1516508357
14.285!LxClient→ LxServr [FIN, ACK] Seq=1 Ack=1 Tsv=2535708305 TSe=1516508357
15.487!LxClient→ LxServr [FIN, ACK] Seq=1 Ack=1 Tsv=2535708606 TSe=1516508357
17.894!LxClient→ LxServr [FIN, ACK] Seq=1 Ack=1 Tsv=2535709208 TSe=1516508357
17.894!LxServr → LxClient[RST] Seq=1
Regards Matthias
.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.