Well, I can't say I understand the solution but I have found the cause of the strange SYN+ACK resetting behavior: the XP firewall. I had disabled my firewall earlier in the week trying to eliminate possible causes of strange behavior. I have fixed several other bugs in the application since then but was never able to resolve the SYN+ACK -> RST problem. On a whim I turned my firewall back on and the application started working! Thanks for your help (the RFC was a good read).
<br><br>Jacob<br><br><div><span class="gmail_quote">On 3/15/06, <b class="gmail_sendername">Jacob Gnarly</b> <<a href="mailto:jacob.gnarly@gmail.com">jacob.gnarly@gmail.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div style="direction: ltr;">Thanks for the quick response. I'll check it out and post the result back to this thread.<br></div><div style="direction: ltr;"><span class="sg"><br>Jacob</span></div><div style="direction: ltr;">
<span class="e" id="q_109feacdbb1cec82_2"><br><br><div><span class="gmail_quote">On 3/14/06, <b class="gmail_sendername">Guy Harris</b> <<a href="mailto:guy@alum.mit.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
guy@alum.mit.edu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Jacob Gnarly wrote:<br>> I hope someone has already seen strange behavior like this and can point
<br>> me in the right direction. I "inherited" an application which creates a<br>> TCP connection with a remote host, sends a small number of packets, and<br>> terminates the connection. The odd behavior that I am finding is that on
<br>> some XP SP2 systems the TCP session works just like you would expect<br>> while other systems have the connection terminated prematurely by the<br>> originator's TCP stack. Instead of the expected SYN/SYN_ACK/ACK
<br>> handshake the originator's TCP stack generates a RST packet as soon as<br>> it receives the SYN_ACK packet back from the remote system and then the<br>> WinPCap program responds with an ACK packet as follows:
<br>> SYN/SYN_ACK/RST/ACK.<br><br>Capture a network trace, look at RFC 793, and see whether the sender of<br>the SYN+ACK packet is violating the TCP spec in some fashion (including<br>"the ACK of the SYN was already sent).
<br>_______________________________________________<br>Winpcap-users mailing list<br><a href="mailto:Winpcap-users@winpcap.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">Winpcap-users@winpcap.org
</a><br><a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br></blockquote></div><br>
</span></div></blockquote></div><br>