why I didn't get three way handshake by tcpdump command?

Question

That's what I do .

1、open tcpdump command sudo tcpdump -i lo0 tcp port 20009

2、start a sample server nc -l 20009

3、connect 20009 port telnet localhost 20009

4、tcpdump command got :

○ → sudo tcpdump  -i lo0 tcp port 20009
Password:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo0, link-type NULL (BSD loopback), capture size 262144 bytes
17:38:42.778304 IP6 localhost.58951 > localhost.20009: Flags [S], seq 4206287588, win 65535, options [mss 16324,nop,wscale 5,nop,nop,TS val 461712269 ecr 0,sackOK,eol], length 0
17:38:42.778341 IP6 localhost.20009 > localhost.58951: Flags [R.], seq 0, ack 4206287589, win 0, length 0
17:38:42.778536 IP localhost.58952 > localhost.20009: Flags [S], seq 2745154881, win 65535, options [mss 16344,nop,wscale 5,nop,nop,TS val 461712269 ecr 0,sackOK,eol], length 0
17:38:42.778614 IP localhost.20009 > localhost.58952: Flags [S.], seq 3385478755, ack 2745154882, win 65535, options [mss 16344,nop,wscale 5,nop,nop,TS val 461712269 ecr 461712269,sackOK,eol], length 0
17:38:42.778629 IP localhost.58952 > localhost.20009: Flags [.], ack 1, win 12759, options [nop,nop,TS val 461712269 ecr 461712269], length 0
17:38:42.778643 IP localhost.20009 > localhost.58952: Flags [.], ack 1, win 12759, options [nop,nop,TS val 461712269 ecr 461712269], length 0

why the client(localhost.58952) don't send back the ack(value 1) to server (localhost.20009) in the third step ?

Answer 1

Your system has defined localhost as both ::1 (ipv6) and 127.0.0.1 (ipv4), so telnet first tries ipv6 and if this fails it tries ipv4. The first packet is a SYN to ::1 but because no process is listening on that address and port, the system responds with a RST (packet 2). Packet 3 is then the SYN to 127.0.0.1 and packet 4 is the SYN+ACK etc.