Matthias Apitz wrote: > Phil, I'm talking about this pkg (the very last one in my posting from > today): > > 13:30:08.499026 IP 10.0.1.40.2546 > xxx.xxx.xxx.xxx.3233: S > 49301289:49301289(0) ack 979701897 win 23360 <mss 536>
I misunderstood, sorry. This packet is not part of the same connection as the rest of the packets in your output. Both the source and destination ports don't match, nor do the sequence or ack numbers. That's a SYN+ACK to some _other_ SYN not shown in your output. That's why Carson pointed out that you didn't include the relevant SYN. -- Phil Dibowitz [EMAIL PROTECTED] Open Source software and tech docs Insanity Palace of Metallica http://www.phildev.net/ http://www.ipom.com/ "Never write it in C if you can do it in 'awk'; Never do it in 'awk' if 'sed' can handle it; Never use 'sed' when 'tr' can do the job; Never invoke 'tr' when 'cat' is sufficient; Avoid using 'cat' whenever possible" -- Taylor's Laws of Programming
signature.asc
Description: OpenPGP digital signature
