0

Using Wireshark I'm observing that all handshake packets starting from first SYN packet are duplicated on two different ports.

SYN packets sent from port 56078 and 56079:

11  22:57:11.726692 X.X.X.X 66  X.X.X.X TCP 56078 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1
12  22:57:11.727364 X.X.X.X 66  X.X.X.X TCP 56079 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1

SYN, ACK received to 56078 and 56079:

14  22:57:11.851809 X.X.X.X 66  X.X.X.X TCP 80 → 56079 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1440 SACK_PERM=1 WS=128
17  22:57:11.852657 X.X.X.X 66  X.X.X.X TCP 80 → 56078 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1440 SACK_PERM=1 WS=128

Same thing with the last ACK packet.

After the handshake, the communication proceeds only on port 56079.

Why does this happen?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.