I have a barcode sensor (Keyence SR-2000) which is able to talk a simple plaintext-based protocol. I could talk to it with the provided (windows-only) app called AutoID Terminal and ontained wireshark dump of those 6 packets exchanged. There is initial connection establishment (as far as I see), then the client sends LON\r (laser on, presumably) and the sensor returns 5678\r (that is the value read from the bar code which is in the front of the sensor). I could also do this connection using telnet client under Windows (or puttty or ncat).
When I tried echo -e 'LON\r' | nc 192.168.100.100 9004 under Linux (or just opening the connection via nc), the connection closes right away. That is, I send SYN but receive RST,ACK (whereas the captured terminal sends SYN and receives the normal SYN,ACK):
Why is it different? Below are expanded dissections, perhaps someone could tell me how to craft the connection establishment so that the client will not RST immediately? Can it be that the client uses some primitive os fingerprint to cut off non-windows clients?
Terminal (working communication) dissection:
1 0.000000 192.168.100.2 192.168.100.100 TCP 66 49956 → 9004 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1
Frame 1: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
Encapsulation type: Ethernet (1)
Arrival Time: Sep 23, 2018 22:25:16.608835000 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1537734316.608835000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Dell_41:75:8e (d0:67:e5:41:75:8e), Dst: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Destination: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Dell_41:75:8e (d0:67:e5:41:75:8e)
Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.2, Dst: 192.168.100.100
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 52
Identification: 0x4366 (17254)
Flags: 0x02 (Don't Fragment)
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (6)
Header checksum: 0x0000 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.100.2
Destination: 192.168.100.100
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 49956, Dst Port: 9004, Seq: 0, Len: 0
Source Port: 49956
Destination Port: 9004
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number)
Acknowledgment number: 0
1000 .... = Header Length: 32 bytes (8)
Flags: 0x002 (SYN)
Window size value: 64240
[Calculated window size: 64240]
Checksum: 0x49de [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
TCP Option - Maximum segment size: 1460 bytes
Kind: Maximum Segment Size (2)
Length: 4
MSS Value: 1460
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - Window scale: 8 (multiply by 256)
Kind: Window Scale (3)
Length: 3
Shift count: 8
[Multiplier: 256]
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - SACK permitted
Kind: SACK Permitted (4)
Length: 2
2 0.000271 192.168.100.100 192.168.100.2 TCP 64 9004 → 49956 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
Encapsulation type: Ethernet (1)
Arrival Time: Sep 23, 2018 22:25:16.609106000 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1537734316.609106000 seconds
[Time delta from previous captured frame: 0.000271000 seconds]
[Time delta from previous displayed frame: 0.000271000 seconds]
[Time since reference or first frame: 0.000271000 seconds]
Frame Number: 2
Frame Length: 64 bytes (512 bits)
Capture Length: 64 bytes (512 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String [truncated]: eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" ||]
Ethernet II, Src: Keyence_2d:82:ba (00:01:fc:2d:82:ba), Dst: Dell_41:75:8e (d0:67:e5:41:75:8e)
Destination: Dell_41:75:8e (d0:67:e5:41:75:8e)
Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Padding: cb92
Frame check sequence: 0x931fe00d incorrect, should be 0xfe3fcdd5
[Expert Info (Error/Checksum): Bad checksum [should be 0xfe3fcdd5]]
[Bad checksum [should be 0xfe3fcdd5]]
[Severity level: Error]
[Group: Checksum]
[FCS Status: Bad]
Internet Protocol Version 4, Src: 192.168.100.100, Dst: 192.168.100.2
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 44
Identification: 0x1a6c (6764)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 60
Protocol: TCP (6)
Header checksum: 0x1aa9 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.100.100
Destination: 192.168.100.2
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 9004, Dst Port: 49956, Seq: 0, Ack: 1, Len: 0
Source Port: 9004
Destination Port: 49956
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
0110 .... = Header Length: 24 bytes (6)
Flags: 0x012 (SYN, ACK)
Window size value: 5840
[Calculated window size: 5840]
Checksum: 0x5566 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
Options: (4 bytes), Maximum segment size
TCP Option - Maximum segment size: 1460 bytes
Kind: Maximum Segment Size (2)
Length: 4
MSS Value: 1460
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 1]
[The RTT to ACK the segment was: 0.000271000 seconds]
[iRTT: 0.000380000 seconds]
3 0.000380 192.168.100.2 192.168.100.100 TCP 54 49956 → 9004 [ACK] Seq=1 Ack=1 Win=64240 Len=0
Frame 3: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0
Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
Encapsulation type: Ethernet (1)
Arrival Time: Sep 23, 2018 22:25:16.609215000 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1537734316.609215000 seconds
[Time delta from previous captured frame: 0.000109000 seconds]
[Time delta from previous displayed frame: 0.000109000 seconds]
[Time since reference or first frame: 0.000380000 seconds]
Frame Number: 3
Frame Length: 54 bytes (432 bits)
Capture Length: 54 bytes (432 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Dell_41:75:8e (d0:67:e5:41:75:8e), Dst: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Destination: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Dell_41:75:8e (d0:67:e5:41:75:8e)
Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.2, Dst: 192.168.100.100
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 40
Identification: 0x4367 (17255)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 128
Protocol: TCP (6)
Header checksum: 0x0000 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.100.2
Destination: 192.168.100.100
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 49956, Dst Port: 9004, Seq: 1, Ack: 1, Len: 0
Source Port: 49956
Destination Port: 9004
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 1 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
0101 .... = Header Length: 20 bytes (5)
Flags: 0x010 (ACK)
Window size value: 64240
[Calculated window size: 64240]
[Window size scaling factor: -2 (no window scaling used)]
Checksum: 0x49d2 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 2]
[The RTT to ACK the segment was: 0.000109000 seconds]
[iRTT: 0.000380000 seconds]
4 1.435465 192.168.100.2 192.168.100.100 TCP 58 49956 → 9004 [PSH, ACK] Seq=1 Ack=1 Win=64240 Len=4
Frame 4: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
Encapsulation type: Ethernet (1)
Arrival Time: Sep 23, 2018 22:25:18.044300000 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1537734318.044300000 seconds
[Time delta from previous captured frame: 1.435085000 seconds]
[Time delta from previous displayed frame: 1.435085000 seconds]
[Time since reference or first frame: 1.435465000 seconds]
Frame Number: 4
Frame Length: 58 bytes (464 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp:data]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Dell_41:75:8e (d0:67:e5:41:75:8e), Dst: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Destination: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Dell_41:75:8e (d0:67:e5:41:75:8e)
Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.2, Dst: 192.168.100.100
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 44
Identification: 0x4368 (17256)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 128
Protocol: TCP (6)
Header checksum: 0x0000 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.100.2
Destination: 192.168.100.100
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 49956, Dst Port: 9004, Seq: 1, Ack: 1, Len: 4
Source Port: 49956
Destination Port: 9004
[Stream index: 0]
[TCP Segment Len: 4]
Sequence number: 1 (relative sequence number)
[Next sequence number: 5 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
0101 .... = Header Length: 20 bytes (5)
Window size value: 64240
[Calculated window size: 64240]
[Window size scaling factor: -2 (no window scaling used)]
Checksum: 0x49d6 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
[SEQ/ACK analysis]
[iRTT: 0.000380000 seconds]
[Bytes in flight: 4]
[Bytes sent since last PSH flag: 4]
TCP payload (4 bytes)
Data (4 bytes)
0000 4c 4f 4e 0d LON.
Data: 4c4f4e0d
[Length: 4]
5 1.505160 192.168.100.100 192.168.100.2 TCP 64 9004 → 49956 [PSH, ACK] Seq=1 Ack=5 Win=5836 Len=5 [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
Encapsulation type: Ethernet (1)
Arrival Time: Sep 23, 2018 22:25:18.113995000 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1537734318.113995000 seconds
[Time delta from previous captured frame: 0.069695000 seconds]
[Time delta from previous displayed frame: 0.069695000 seconds]
[Time since reference or first frame: 1.505160000 seconds]
Frame Number: 5
Frame Length: 64 bytes (512 bits)
Capture Length: 64 bytes (512 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp:data]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String [truncated]: eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" ||]
Ethernet II, Src: Keyence_2d:82:ba (00:01:fc:2d:82:ba), Dst: Dell_41:75:8e (d0:67:e5:41:75:8e)
Destination: Dell_41:75:8e (d0:67:e5:41:75:8e)
Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Padding: 75
Frame check sequence: 0x0c9736ac incorrect, should be 0xc47707cc
[Expert Info (Error/Checksum): Bad checksum [should be 0xc47707cc]]
[Bad checksum [should be 0xc47707cc]]
[Severity level: Error]
[Group: Checksum]
[FCS Status: Bad]
Internet Protocol Version 4, Src: 192.168.100.100, Dst: 192.168.100.2
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 45
Identification: 0x1a6d (6765)
Flags: 0x00
Fragment offset: 0
Time to live: 60
Protocol: TCP (6)
Header checksum: 0x1aa7 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.100.100
Destination: 192.168.100.2
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 9004, Dst Port: 49956, Seq: 1, Ack: 5, Len: 5
Source Port: 9004
Destination Port: 49956
[Stream index: 0]
[TCP Segment Len: 5]
Sequence number: 1 (relative sequence number)
[Next sequence number: 6 (relative sequence number)]
Acknowledgment number: 5 (relative ack number)
0101 .... = Header Length: 20 bytes (5)
Flags: 0x018 (PSH, ACK)
Window size value: 5836
[Calculated window size: 5836]
[Window size scaling factor: -2 (no window scaling used)]
Checksum: 0xf3a7 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 4]
[The RTT to ACK the segment was: 0.069695000 seconds]
[iRTT: 0.000380000 seconds]
[Bytes in flight: 5]
[Bytes sent since last PSH flag: 5]
TCP payload (5 bytes)
Data (5 bytes)
0000 35 36 37 38 0d 5678.
Data: 353637380d
[Length: 5]
Failed communication with netcat dissection:
No. Time Source Destination Protocol Length Info
1 0.000000000 192.168.100.1 192.168.100.100 TCP 76 35464 → 9004 [SYN] Seq=0 Win=26880 Len=0 MSS=8960 SACK_PERM=1 TSval=2472528447 TSecr=0 WS=128
Frame 1: 76 bytes on wire (608 bits), 76 bytes captured (608 bits) on interface 0
Interface id: 0 (any)
Interface name: any
Encapsulation type: Linux cooked-mode capture (25)
Arrival Time: Sep 23, 2018 23:09:24.649574189 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1537736964.649574189 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 76 bytes (608 bits)
Capture Length: 76 bytes (608 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: sll:ethertype:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Linux cooked capture
Packet type: Sent by us (4)
Link-layer address type: 1
Link-layer address length: 6
Source: AsustekC_da:88:12 (bc:ee:7b:da:88:12)
Unused: 0000
Protocol: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.1, Dst: 192.168.100.100
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 60
Identification: 0x493d (18749)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0xa7c8 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.100.1
Destination: 192.168.100.100
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 35464, Dst Port: 9004, Seq: 0, Len: 0
Source Port: 35464
Destination Port: 9004
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number)
Acknowledgment number: 0
1010 .... = Header Length: 40 bytes (10)
Flags: 0x002 (SYN)
Window size value: 26880
[Calculated window size: 26880]
Checksum: 0x49e5 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
TCP Option - Maximum segment size: 8960 bytes
Kind: Maximum Segment Size (2)
Length: 4
MSS Value: 8960
TCP Option - SACK permitted
Kind: SACK Permitted (4)
Length: 2
TCP Option - Timestamps: TSval 2472528447, TSecr 0
Kind: Time Stamp Option (8)
Length: 10
Timestamp value: 2472528447
Timestamp echo reply: 0
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - Window scale: 7 (multiply by 128)
Kind: Window Scale (3)
Length: 3
Shift count: 7
[Multiplier: 128]
No. Time Source Destination Protocol Length Info
2 0.000210935 192.168.100.100 192.168.100.1 TCP 66 9004 → 35464 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
Frame 2: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0 (any)
Interface name: any
Encapsulation type: Linux cooked-mode capture (25)
Arrival Time: Sep 23, 2018 23:09:24.649785124 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1537736964.649785124 seconds
[Time delta from previous captured frame: 0.000210935 seconds]
[Time delta from previous displayed frame: 0.000210935 seconds]
[Time since reference or first frame: 0.000210935 seconds]
Frame Number: 2
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: sll:ethertype:ip:tcp:vssmonitoring]
[Coloring Rule Name: TCP RST]
[Coloring Rule String: tcp.flags.reset eq 1]
Linux cooked capture
Packet type: Unicast to us (0)
Link-layer address type: 1
Link-layer address length: 6
Source: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
Unused: 0000
Protocol: IPv4 (0x0800)
Padding: 35363738
Internet Protocol Version 4, Src: 192.168.100.100, Dst: 192.168.100.1
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 40
Identification: 0x1aa4 (6820)
Flags: 0x00
Fragment offset: 0
Time to live: 60
Protocol: TCP (6)
Header checksum: 0x1a76 [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.100.100
Destination: 192.168.100.1
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 9004, Dst Port: 35464, Seq: 1, Ack: 1, Len: 0
Source Port: 9004
Destination Port: 35464
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 1 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
0101 .... = Header Length: 20 bytes (5)
Flags: 0x014 (RST, ACK)
Window size value: 0
[Calculated window size: 0]
[Window size scaling factor: -1 (unknown)]
Checksum: 0xfff0 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 1]
[The RTT to ACK the segment was: 0.000210935 seconds]
[iRTT: 0.000210935 seconds]
VSS-Monitoring ethernet trailer, Source Port: 3412
Src Port: 3412
