Skip to main content
4 votes

How does leaving a TCP connection half-open makes SYN and SYN+ACK stealth and absent from the logs?

There is no mandate, but the most common operating systems log only when the connection is fully established. As for the reason for that decision, you would have to ask the software authors (...
Ron Trunk's user avatar
  • 67.7k
2 votes

How does leaving a TCP connection half-open makes SYN and SYN+ACK stealth and absent from the logs?

TCP uses a "three-way handshake" which is actually four way. Each side sends a SYNchronize packet with its initial sequence number and the other side ACKnowledges the sequence number and ...
Zac67's user avatar
  • 85.4k
1 vote

Cisco ports shutting down temporally due to arp-inspection

While the first message from your log excerpts hints at storm control being the culprit ..... Attempting to recover from storm-control err-disable ... the latter occurrences are a clear hint that ...
Marc 'netztier' Luethi's user avatar
1 vote
Accepted

Does this DHCP Server need a trusted ARP Inspection port in IOS?

Dynamic ARP inspection is based on DHCP snooping. The switch snoops DHCP and ensures that all nodes can only use the IP address they are granted by DHCP. DHCP snooping requires a host or port to be ...
Zac67's user avatar
  • 85.4k

Only top scored, non community-wiki answers of a minimum length are eligible