Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B

I captured packets on the client host and server host, and got the captured file as below

client: https://docs.google.com/file/d/0B09y_TWqTtwlZ1NleS1NNmR4Sk0/edit?usp=sharing

server: https://docs.google.com/file/d/0B09y_TWqTtwlc3lZUmNyV1R4X0k/edit?usp=sharing

there are 3 packets, SYN, SYN/ACK, AKC on the client side, the wireshark interace shows that this is a normal tcp 3-way handshake, but on the server side, it shows : tcp port numbers reused, what is wrong with this?

but when I use

netstat -tnp

I see the tcp connection has been established what is wrong with this? thanks!

share|improve this question
Your wireshark log is incomplete: On the server side, you should see the syn packet coming in from 201.109. I suspect I know what the problem is, but having more of the log would really be helpful. –  BigHomie Mar 18 '13 at 13:52
The full wireshark log. Did you have any filters on when you saved the logs? You should turn them off if so. –  BigHomie Mar 18 '13 at 14:29
they are the full wireshark log, the server machine is a PlanetLab node. so what do you guess are the potential reasons? –  user138126 Mar 18 '13 at 14:40
besides, I see from netstat -tnp that the tcp connection is established, so I use raw socket to create some data packets, with the correct sequence number, ack_seq number , source port and destination port, but the server side doesn't receive the packet, why? –  user138126 Mar 18 '13 at 14:41
So, you're saying that these two computers have no other network traffic on these interfaces? –  BigHomie Mar 18 '13 at 14:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.