From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ramin Alidousti Subject: Re: detection of the third tcp packet in a tcp connection setup Date: Thu, 27 Jun 2002 15:39:32 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <20020627193932.GY31466@cannon.eng.us.uu.net> References: <20020627193043.UMUP19225.mta07-svc.ntlworld.com@there> <20020627214407.F2890@oknodo.bof.de> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <20020627214407.F2890@oknodo.bof.de> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Patrick Schaaf Cc: Antony Stone , netfilter@lists.samba.org On Thu, Jun 27, 2002 at 09:44:07PM +0200, Patrick Schaaf wrote: > > > There are some distinguishing characteristics... it is the first packet > > > sent by the client that is in state ESTABLISHED. it should have ACK set > > > and no other flags. the tcp data length should be zero. > > > > Isn't that in itself a bit of a giveaway ? I can't think of a reason why a > > zero-length packet should ever occur in the remainder of the data stream... ? > > How to TCP keepalive packets look like? Also, isn't it possible that the > third packet already carries data, in the general (read TCP protocol as > it is written) case? You probably won't get that with the normal socket > interface from userlevel, but does TCP forbid it? I don't think so. Correct. And besides when you receive data and have nothing to send you'll ack with a zero-length packet. Ramin > > best regards > Patrick