What you are seeing is normal behavior if a previous TCP connection did not get shut down properly.
If the port numbers match a previous connection which was completely closed on the client but remains established on the server, the sequence you see will happen.
The client will send a
SYN, because it does not recall the old connection. The server will see the
SYN arriving on a connection in established state, which is unexpected. But since it is a valid connection, the server cannot respond with a
RST. Instead it will send an
ACK corresponding to the current sequence numbers known to the server.
The client will receiver an
ACK for a connection that is not yet established. First packet in each direction is required to have the
SYN bit set. So the client knows the
ACK is for a previous connection and will respond with a
RST will clear the old connection from the server.
RST packets have been send, the client can retransmit the
SYN packet. This time the handshake will work.
There are multiple possible reasons for the old connection ending up in the broken state in the first place. Here are a few possibilities:
- The network connection was down for a couple of minutes when the old connection was closed.
- The client machine was rebooted.
- One of the IP addresses was reassigned to a different machine while a connection was established.
- You have a misbehaving middlebox somewhere between client and server (that could be a NAT or a firewall).