Ask Your Question
0

No tcp-syn packet or tcp-fin packets.

asked 2020-04-30 04:04:37 +0000

gopal_72 gravatar image

For a conversation between two IP address, there is neither TCP-syn packet nor TCP-fin packet. So, in that case, how does the connection establishment and teardown have happened?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-04-30 09:07:27 +0000

grahamb gravatar image

The missing events definitely happened, you just didn't capture them. Note that you might not get a FIN, RST may be used instead.

edit flag offensive delete link more

Comments

Another possible point of failure is selecting application payloads. For instance, if you

Follow TCP stream

you will get SYN and FIN packets IF they were captured. Let's pretend, for arguments sake, this TCP stream contains TLS, so if you filter on

tls

then the TCP setup/teardown or discrete ACKs would not be visible. Only thing that shows is those TCP packets that contain TLS. Similar to http protocol, etc.

Bob Jones gravatar imageBob Jones ( 2020-04-30 15:05:31 +0000 )edit

I hadn't thought that the user could have filtered them out.

grahamb gravatar imagegrahamb ( 2020-04-30 15:20:32 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2020-04-30 04:04:37 +0000

Seen: 43 times

Last updated: Apr 30