Has anyone seen a server change the dest port on a syn-ack?

asked 2022-09-27 16:48:10 +0000

todd_soma@yahoo.com gravatar image

syn comes in port src 27373 dst 1445. syn-ack uses ports src 1445 dst 14019

edit retag flag offensive close merge delete

Comments

Could be a NAPT going wrong.

Jaap gravatar imageJaap ( 2022-09-28 06:26:04 +0000 )edit

I found that the source server uses an F5 LB as a default gateway

todd_soma@yahoo.com gravatar image[email protected] ( 2022-09-28 12:58:49 +0000 )edit

Sounds suspiciously like a misconfiguration in the F5.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2022-09-29 10:10:11 +0000 )edit
add a comment