Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B

I captured packets on the client host and server host, and got the captured file as below



there are 3 packets, SYN, SYN/ACK, AKC on the client side, the wireshark interace shows that this is a normal tcp 3-way handshake, but on the server side, it shows : tcp port numbers reused, what is wrong with this?

but when I use

netstat -tnp

I see the tcp connection has been established what is wrong with this? thanks!

share|improve this question
Your wireshark log is incomplete: On the server side, you should see the syn packet coming in from 201.109. I suspect I know what the problem is, but having more of the log would really be helpful. – BigHomie Mar 18 '13 at 13:52
The full wireshark log. Did you have any filters on when you saved the logs? You should turn them off if so. – BigHomie Mar 18 '13 at 14:29
they are the full wireshark log, the server machine is a PlanetLab node. so what do you guess are the potential reasons? – user138126 Mar 18 '13 at 14:40
besides, I see from netstat -tnp that the tcp connection is established, so I use raw socket to create some data packets, with the correct sequence number, ack_seq number , source port and destination port, but the server side doesn't receive the packet, why? – user138126 Mar 18 '13 at 14:41
So, you're saying that these two computers have no other network traffic on these interfaces? – BigHomie Mar 18 '13 at 14:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.