I have found out a strange behaviour when trying to establish TCP session between Citrix host and back-end server on port 5060. When I perform 'telent 172.18.52.73 5060' from Citrix host I get "connected to..." message. The thing is that the destination server isn't listening on TCP port 5060 and I shoudn't get this message.
According to the Wireshark results, destination server doesn't reply to 'TCP SYN' packet with 'TCP SYN, ACK' but it rather sends TCP retransmission.
But when I check Wireshark results on the Citrix host (source of the traffic), I can see that session is established anyway, please see it below.
Another thing is that when I get "connected to" message on Citrix host it isn't possible to send anything through it. I mean If I try to hit enter or any other key the session is imidiately closed. You can also see it in the picture above.
This isn't currently affecting our network, but I'm simply wondering why it's happening. I have never seen it before. Bug, feature or Malware?
Drawing for a better understanding:
Many thanks for any hits on that.