0
votes

It depends on the iphdr.saddr field. When it was set to my own address or a random multicast address, I can see the server replied with the syn/ack packet. If set to other ips, the server didn't reply. How to explain it?

The multicast address case: 13:55:08.242535 IP 240.151.224.61.13579 > localhost.5223: Flags [S], seq 123456, win 4096, length 0 E..(g+..@......=....5..g...@....P...$X.. 13:55:14.906511 IP 239.151.224.61.13579 > localhost.5223: Flags [S], seq 123456, win 4096, length 0 E..(g+..@......=....5..g...@....P...%X.. 13:55:14.906549 IP localhost.5223 > 239.151.224.61.13579: Flags [S.], seq 3502093187, ack 123457, win 43690, options [mss 65495], length 0 E..,..@.@..........=.g5........A...N....... 13:55:15.904599 IP localhost.5223 > 239.151.224.61.13579: Flags [S.], seq 3502093187, ack 123457, win 43690, options [mss 65495], length 0

`

my own address case: 14:14:22.989225 IP slave1.domain.com.13579 > localhost.5223: Flags [S], seq 123456, win 4096, length 0 E..(g+..@......m....5..g...@....P...3... 14:14:22.989236 IP localhost.5223 > slave1.domain.com.13579: Flags [S.], seq 3228604881, ack 123457, win 43690, options [mss 65495], length 0 E..,..@.@..........m.g5..p.....A...A5...... 14:14:22.989259 IP slave1.domain.com.13579 > localhost.5223: Flags [.], ack 3228604882, win 4096, length 0 E..(..@.@......m....5..g...A.p..P....... `

no syn/ack reply case: 14:16:18.719629 IP 223.151.224.61.13579 > localhost.5223: Flags [S], seq 123456, win 4096, length 0 E..(g+..@......=....5..g...@....P...5X.. 14:16:46.511299 IP 240.151.224.61.13579 > localhost.5223: Flags [S], seq 123456, win 4096, length 0 E..(g+..@......=....5..g...@....P...$X..

1

1 Answers

0
votes

iphdr.saddr represents the source address of the IP packet. I assume that the receiving end of your SYN packet will try to respond with an ACK to whatever source address you provide in the IP packet.