Tcp: Server Sends [Rst, Ack] Immediately After Receiving [Syn] from Client

TCP: Server sends [RST, ACK] immediately after receiving [SYN] from Client

RST, ACK means the port is closed. You sure Host_B is listening on the right IP/interface?

Also check your firewall for a -j REJECT --reject-with tcp-reset

Client sends [RST] after receive [SYN, ACK]

The problem is that your OS is receiving the SYN-ACK packet, has no idea why it was sent (as the OS itself didn't start a handshake) and reset the connection.

You can find some solutions here (for Linux)-
Unwanted RST TCP packet with Scapy

Another option is to use a different IP than the OS's, or in Windows turn off the IP stack of the used interface (only if this is the only thing that you use this interface for!)

After establishing the TCP connection, the server sends an RST message to the client, why?

you might need to take a look at this answer. The answer suspects that the port might not be correct or a firewall issue.

why kernel sent RST to a remote TCP server after the machine receiving a SYN/ACK packet?

This is perfectly normal. If a machine receives a SYN/ACK packet it doesn't expect, it should respond with a RST to let the other side know that it has no knowledge of or interest in that connection. The kernel sent a RST because that's what it's supposed to do -- it has no idea what your program is doing.

If you're trying to run your own TCP stack on a machine that already has a TCP stack, you'll have to prevent the regular TCP stack from responding to machines your stack is trying to talk to -- otherwise, they'll be talking to two TCP stacks which can't possibly work.

Kernel? sends RST after handcrafted SYN/ACK frame

It looks like you're responding with incorrect ack number in your handcrafted SYN/ACK packet. It should be sequence number from SYN packet plus 1.

Compare the sequence and ack numbers from "working case":

SYN
0020   .. .. .. .. .. .. 59 cc e9 d7 00 00 00 00 .. ..   .....XY.........
                         \---seq---/ \---ack---/
SYN/ACK
0020   .. .. .. .. .. .. cf 89 17 79 59 cc e9 d8 .. ..   ...X.....yY.....
                         \---seq---/ \---ack---/

And the "non working" case:

SYN
0020   .. .. .. .. .. .. 4d 0e 47 f3 00 00 00 00 .. ..   .....XM.G.......
                         \---seq---/ \---ack---/
SYN/ACK
0020   .. .. .. .. .. .. b6 a4 00 00 4d 0e 47 f3 .. ..   ...X......M.G...
                         \---seq---/ \---ack---/

---

Related Topics