I eventually sometimes watch most initial tcp connection attempts like this:

tcpdump -nn -Z somepcapuser not src host (12x.x5.109.xxx or 62.75.160.xxx ) and not (port 9001 or 443 or 8080 ) and tcp[tcpflags]&(tcp-syn) !=0 and not tcp[tcpflags]& (tcp-ack) !=0 or icmp

this works pretty well to quickly identify oddness so far. However, I now have a question on the following output:

03:53:52.227884 IP > 62.75.160.xxx.80: S 846930886:846930886(0) win 61690 "<"mss 1460,nop,nop,sackOK,opt-178:f04700000000,nop,wscale 4">"

I wonder what the marked portion means, haven't seen that before.

Thanks for help wlaus


This is TCP options. tcpdump can understand it. I'm not sure, but look like timestamp:

f04700 - current timestamp
000000 - previous timestamp

178 is probably offset from the start TCP options

  • Hm, you might be right, however newer tcpdump reports it as: "Flags [S], seq 846930886, win 61690, options [mss 1460,nop,nop,sackOK,Unknown Option 178f04700000000,nop,wscale 4], length 0" and wireshark says "broken TCP" (ack field set, while ack bit is not), will provide some full capture later this day. – wlaus Mar 2 '11 at 5:05

Maybe try feeding tcpdump capture to Wireshark? It nicely spells out meaning of packet content.

  • Hi Pawel, see my other answer below or have a look at the dump above. – wlaus Mar 2 '11 at 22:21
  • @wlaus Hi, wlaus, I've fed your capture to Wireshark and it said "unknown options". :( – Paweł Brodacki Mar 10 '11 at 17:54

Have seen this as well on several IDS's lately - 10000's of these directed at ports 80 & 443 from diverse sources - Myanmar, India, China... Definitely generated by the same software - always SYN, SEQ & ACK fields always identical. Weird. New exploit?


There is now an offical sans diary entry:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.