Ask Your Question
0

TCP Port numbers reused

asked 2024-04-16 14:19:48 +0000

7ACE gravatar image

updated 2024-04-16 14:53:46 +0000

grahamb gravatar image

Hi experts,

For the pcap, SYN、SYN/ACK、RST、SYN、SYN/ACK、RST, When I ignore the No.4 SYN packet,Why is packet No.2 marked with "TCP Port numbers reused"? tcpd == NULL?

No. Source       Destination  Protocol Stream Length Info
1   10.83.12.253 10.92.54.95  TCP        0    62     54321 > 447 [SYN] Seq=0 Win=14600 Len=0
2   10.92.54.95  10.83.12.253 TCP        0    60     [TCP Port numbers reused] 447  >  54321 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460
3   10.83.12.253 10.92.54.95  TCP        0    62     54321 > 447 [RST] Seq=1 Win=0 Len=0
4   <Ignored>
5   10.92.54.95  10.83.12.253 TCP        0    60     [TCP Previous segment not captured] [TCP Port numbers reused] 447  >  54321 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460
6   10.83.12.253 10.92.54.95  TCP        0    62     54321 > 447 [RST] Seq=1 Win=0 Len=0

The relevant code:

packet-tcp.c
SYN
if (tcpd != NULL  && (tcph->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) {
    ...
    tcpd->ta->flags|=TCP_A_REUSED_PORTS;
    ...
}

SYN/ACK
if (tcpd != NULL && (tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)){
    ...
    tcpd->ta->flags|=TCP_A_REUSED_PORTS;
    ...
}

Regards, 7ACE

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2024-04-18 01:18:22 +0000

Chuckc gravatar image
edit flag offensive delete link more

Comments

Thank you for the explanation.

7ACE gravatar image7ACE ( 2024-04-18 12:15:43 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-04-16 14:19:48 +0000

Seen: 241 times

Last updated: Apr 18