From: Patrick Schaaf <bof@bof.de>
To: Antony Stone <Antony@Soft-Solutions.co.uk>
Cc: netfilter@lists.samba.org
Subject: Re: detection of the third tcp packet in a tcp connection setup
Date: Thu, 27 Jun 2002 21:44:07 +0200 [thread overview]
Message-ID: <20020627214407.F2890@oknodo.bof.de> (raw)
In-Reply-To: <20020627193043.UMUP19225.mta07-svc.ntlworld.com@there>; from Antony@Soft-Solutions.co.uk on Thu, Jun 27, 2002 at 08:30:41PM +0100
> > There are some distinguishing characteristics... it is the first packet
> > sent by the client that is in state ESTABLISHED. it should have ACK set
> > and no other flags. the tcp data length should be zero.
>
> Isn't that in itself a bit of a giveaway ? I can't think of a reason why a
> zero-length packet should ever occur in the remainder of the data stream... ?
How to TCP keepalive packets look like? Also, isn't it possible that the
third packet already carries data, in the general (read TCP protocol as
it is written) case? You probably won't get that with the normal socket
interface from userlevel, but does TCP forbid it? I don't think so.
best regards
Patrick
next prev parent reply other threads:[~2002-06-27 19:44 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-27 18:27 detection of the third tcp packet in a tcp connection setup Ramin Alidousti
2002-06-27 18:36 ` Antony Stone
2002-06-27 18:52 ` Antony Stone
2002-06-27 19:08 ` Ramin Alidousti
2002-06-27 18:53 ` Patrick Schaaf
2002-06-27 19:04 ` Ramin Alidousti
2002-06-27 18:57 ` Maciej Soltysiak
2002-06-27 19:10 ` Joe Patterson
2002-06-27 19:30 ` Antony Stone
2002-06-27 19:44 ` Patrick Schaaf [this message]
2002-06-27 19:39 ` Ramin Alidousti
2002-06-27 19:49 ` Maciej Soltysiak
2002-06-27 21:41 ` Matthew G. Marsh
2002-06-27 19:44 ` Antony Stone
2002-06-27 19:57 ` Ramin Alidousti
2002-06-27 20:06 ` Antony Stone
2002-06-27 20:31 ` Ramin Alidousti
2002-06-27 20:36 ` Antony Stone
2002-06-27 19:50 ` Joe Patterson
2002-06-27 20:11 ` Patrick Schaaf
2002-06-27 21:23 ` James Mello
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020627214407.F2890@oknodo.bof.de \
--to=bof@bof.de \
--cc=Antony@Soft-Solutions.co.uk \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox