[Winpcap-users] TCP stack resets connections established by WinPCap on XP SP2

[Jacob Gnarly]

Well, I can't say I understand the solution but I have found the cause of
the strange SYN+ACK resetting behavior: the XP firewall. I had disabled my
firewall earlier in the week trying to eliminate possible causes of strange
behavior. I have fixed several other bugs in the application since then but
was never able to resolve the SYN+ACK -> RST problem. On a whim I turned my
firewall back on and the application started working! Thanks for your help
(the RFC was a good read).

Jacob

On 3/15/06, Jacob Gnarly <jacob.gnarly at gmail.com> wrote:
>
> Thanks for the quick response. I'll check it out and post the result back
> to this thread.
>
> Jacob
>
>
> On 3/14/06, Guy Harris < guy at alum.mit.edu> wrote:
> >
> > Jacob Gnarly wrote:
> > > I hope someone has already seen strange behavior like this and can
> > point
> > > me in the right direction. I "inherited" an application which creates
> > a
> > > TCP connection with a remote host, sends a small number of packets,
> > and
> > > terminates the connection. The odd behavior that I am finding is that
> > on
> > > some XP SP2 systems the TCP session works just like you would expect
> > > while other systems have the connection terminated prematurely by the
> > > originator's TCP stack.  Instead of the expected SYN/SYN_ACK/ACK
> > > handshake the originator's TCP stack generates a RST packet as soon as
> > > it receives the SYN_ACK packet back from the remote system and then
> > the
> > > WinPCap program responds with an ACK packet as follows:
> > > SYN/SYN_ACK/RST/ACK.
> >
> > Capture a network trace, look at RFC 793, and see whether the sender of
> > the SYN+ACK packet is violating the TCP spec in some fashion (including
> > "the ACK of the SYN was already sent).
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20060315/726a9fb0/attachment-0001.htm