0

That's what I do .

1、open tcpdump command sudo tcpdump -i lo0 tcp port 20009

2、start a sample server nc -l 20009

3、connect 20009 port telnet localhost 20009

4、tcpdump command got :

○ → sudo tcpdump  -i lo0 tcp port 20009
Password:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo0, link-type NULL (BSD loopback), capture size 262144 bytes
17:38:42.778304 IP6 localhost.58951 > localhost.20009: Flags [S], seq 4206287588, win 65535, options [mss 16324,nop,wscale 5,nop,nop,TS val 461712269 ecr 0,sackOK,eol], length 0
17:38:42.778341 IP6 localhost.20009 > localhost.58951: Flags [R.], seq 0, ack 4206287589, win 0, length 0
17:38:42.778536 IP localhost.58952 > localhost.20009: Flags [S], seq 2745154881, win 65535, options [mss 16344,nop,wscale 5,nop,nop,TS val 461712269 ecr 0,sackOK,eol], length 0
17:38:42.778614 IP localhost.20009 > localhost.58952: Flags [S.], seq 3385478755, ack 2745154882, win 65535, options [mss 16344,nop,wscale 5,nop,nop,TS val 461712269 ecr 461712269,sackOK,eol], length 0
17:38:42.778629 IP localhost.58952 > localhost.20009: Flags [.], ack 1, win 12759, options [nop,nop,TS val 461712269 ecr 461712269], length 0
17:38:42.778643 IP localhost.20009 > localhost.58952: Flags [.], ack 1, win 12759, options [nop,nop,TS val 461712269 ecr 461712269], length 0

why the client(localhost.58952) don't send back the ack(value 1) to server (localhost.20009) in the third step ?

3

Your system has defined localhost as both ::1 (ipv6) and 127.0.0.1 (ipv4), so telnet first tries ipv6 and if this fails it tries ipv4. The first packet is a SYN to ::1 but because no process is listening on that address and port, the system responds with a RST (packet 2). Packet 3 is then the SYN to 127.0.0.1 and packet 4 is the SYN+ACK etc.

2
  • What about the packet 6 ? Why need this ?
    – shaoyihe
    Oct 2 '16 at 4:15
  • Packet 6 seems to be a Window Update, i.e. in packet 4 (SYN+ACK) we see win 65535 and in packet 6 it is win 12759. Why it is doing that, I have no idea to be honest.
    – hertitu
    Oct 5 '16 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.