-- Ftester Config
flags: -d 0.25 -s 1 -F
10.170.101.113:1024:10.206.160.58:5500-5520:S:TCP:0
-- Ftester TCP Port 5508 --
75 8.102952 10.170.101.113 10.206.160.58 TCP 1024 > 5508 [SYN] Seq=0 Win=65535 Len=15
76 8.106778 10.206.160.58 10.170.101.113 TCP 5508 > 1024 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
-- Ftester TCP Port 5509 --
77 8.387007 10.170.101.113 10.206.160.58 TCP 1024 > 5509 [SYN] Seq=0 Win=65535 Len=15
78 8.390625 10.206.160.58 10.170.101.113 TCP 5509 > 1024 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
-- Manual SSH Connection as Example --
135 13.204917 10.11.12.117 10.11.12.1 TCP 49310 > ssh [SYN] Seq=0 Win=8192 [TCP CHECKSUM INCORRECT] Len=0 MSS=1460 WS=8
136 13.206375 10.11.12.1 10.11.12.117 TCP ssh > 49310 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 WS=2
137 13.206484 10.11.12.117 10.11.12.1 TCP 49310 > ssh [ACK] Seq=1 Ack=1 Win=65536 [TCP CHECKSUM INCORRECT] Len=0
...
311 26.220628 10.11.12.117 10.11.12.1 TCP 49310 > ssh [FIN, ACK] Seq=2217 Ack=2817 Win=64256 [TCP CHECKSUM INCORRECT] Len=0
312 26.224147 10.11.12.1 10.11.12.117 TCP ssh > 49310 [FIN, ACK] Seq=2817 Ack=2218 Win=10128 Len=0
313 26.224247 10.11.12.117 10.11.12.1 TCP 49310 > ssh [ACK] Seq=2218 Ack=2818 Win=64256 [TCP CHECKSUM INCORRECT] Len=0
Here i looked up the tcp handshake:
Connection establishment (http://en.wikipedia.org/wiki/Transmission_Control_Protocol)
Example:
1. The initiating host (client) sends a synchronization packet (SYN flag set to 1) to initiate a connection. It sets the packet's sequence number to a random value x.
2. The other host receives the packet, records the sequence number x from the client, and replies with an acknowledgment and synchronization (SYN-ACK). The Acknowledgment is a 32-bit field in TCP segment header. It contains the next sequence number that this host is expecting to receive (x + 1). The host also initiates a return session. This includes a TCP segment with its own initial Sequence Number of value y.
3. The initiating host responds with the next Sequence Number (x + 1) and a simple Acknowledgment Number value of y + 1, which is the Sequence Number value of the other host + 1.