You should give more pieces of information to have precise scenario :
Where are you sniffing this ? (ie on the LAN of A? near a router, from the
side of A ? Are the TCP ports always the same ?)
In the first case, it could be a deficient link, a packet dropped by B or
by a firewall before B (with a rule like ipchain DENY one), or maybe a
scanport on a machine that DENY a lot of ports ?
The second case could be a scanport on B, or a deficient link, or a router
on the path with a bad return route (in this case, you are on B side).
Anyway, all these sequences are aborted TCP sequences. They should always
terminate with a TCP_FIN sequence or a TCP_RST packet.
You can look at the RFC for documentation. There is a very clear
finite state automaton.
Phil
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
