Thanks for the quick response. I'll check it out and post the result back to this thread.<br><br>Jacob<br><br><div><span class="gmail_quote">On 3/14/06, <b class="gmail_sendername">Guy Harris</b> <<a href="mailto:guy@alum.mit.edu">
guy@alum.mit.edu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Jacob Gnarly wrote:<br>> I hope someone has already seen strange behavior like this and can point
<br>> me in the right direction. I "inherited" an application which creates a<br>> TCP connection with a remote host, sends a small number of packets, and<br>> terminates the connection. The odd behavior that I am finding is that on
<br>> some XP SP2 systems the TCP session works just like you would expect<br>> while other systems have the connection terminated prematurely by the<br>> originator's TCP stack. Instead of the expected SYN/SYN_ACK/ACK
<br>> handshake the originator's TCP stack generates a RST packet as soon as<br>> it receives the SYN_ACK packet back from the remote system and then the<br>> WinPCap program responds with an ACK packet as follows:
<br>> SYN/SYN_ACK/RST/ACK.<br><br>Capture a network trace, look at RFC 793, and see whether the sender of<br>the SYN+ACK packet is violating the TCP spec in some fashion (including<br>"the ACK of the SYN was already sent).
<br>_______________________________________________<br>Winpcap-users mailing list<br><a href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br><a href="https://www.winpcap.org/mailman/listinfo/winpcap-users">
https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br></blockquote></div><br>