Sunday, July 6, 2014

Stimulus and Response - TCP - Setting 3 flags

In the 2 previous posts within this series, we looked at setting 1, then 2 flags. In this post we will set 3 flags. So without further ado, let's look at setting 3 flags.

--------------------------------------------------------------

URG-ACK-PSH -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="UAP"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  2   8.050680    10.0.0.50 -> 10.0.0.100   TCP 54 [TCP Window Update] 5000 > 80 [PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  3   8.051269   10.0.0.100 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0
  4   8.051409    10.0.0.50 -> 10.0.0.101   TCP 54 [TCP Window Update] 5000 > 80 [PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  5   8.051824   10.0.0.101 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the URG-ACK-PSH flags set, sent to LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the URG-ACK-PSH flags set, sent to LISTENING PORT, results in a RST


URG-ACK-PSH -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="UAP"),iface='eth0', count=1)..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 [TCP Window Update] 5000 > 81 [PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  2   0.001082    10.0.0.50 -> 10.0.0.101   TCP 54 [TCP Window Update] 5000 > 81 [PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  3   0.001108   10.0.0.100 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0
  4   0.001380   10.0.0.101 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the URG-ACK-PSH flags set, sent to NON-LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the URG-ACK-PSH flags set, sent to NON-LISTENING PORT, results in a RST

--------------------------------------------------------------

URG-ACK-RST -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="UAR"),iface='eth0', count=1)..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [RST, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  2   0.002009    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [RST, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0


From the above:
Windows 2012 - Packet with URG-ACK-RST flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with URG-ACK-RST flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


URG-ACK-RST -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="UAR"),iface='eth0', count=1)..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  5   3.290352    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [RST, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  8   3.299002    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [RST, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0



From the above:
Windows 2012 - Packet with URG-ACK-RST flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with URG-ACK-RST flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


--------------------------------------------------------------

URG-ACK-SYN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="UAS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  2   0.000730   10.0.0.100 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0
  3   0.000971    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  4   0.001447   10.0.0.101 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the URG-ACK-SYN flags set, sent to LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the URG-ACK-SYN flags set, sent to LISTENING PORT, results in a RST


URG-ACK-SYN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="UAS"),iface='eth0', count=1)
..
Sent 2 packets.


root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  3   8.777791    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  6   8.778659   10.0.0.100 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0
  9   8.784533    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
 12   8.786545   10.0.0.101 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the URG-ACK-SYN flags set, sent to NON-LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the URG-ACK-SYN flags set, sent to NON-LISTENING PORT, results in a RST

--------------------------------------------------------------

URG-ACK-FIN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="UAF"),iface='eth0', count=1)..
Sent 2 packets

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  2   2.193187    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  5   2.194752   10.0.0.100 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0
  8   2.217398    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
 11   2.218462   10.0.0.101 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the URG-ACK-FIN flags set, sent to LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the URG-ACK-FIN flags set, sent to LISTENING PORT, results in a RST


URG-ACK-FIN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="UAF"),iface='eth0', count=1)..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  3   6.952935    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  6   6.954813   10.0.0.100 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0
  9   6.960017    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
 10   6.960799   10.0.0.101 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the URG-ACK-FIN flags set, sent to NON-LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the URG-ACK-FIN flags set, sent to NON-LISTENING PORT, results in a RST

--------------------------------------------------------------

FIN-SYN-RST -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="FSR"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, SYN, RST] Seq=0 Win=8192 Len=0
  4   0.006779    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, SYN, RST] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with FIN-SYN-RST flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with FIN-SYN-RST flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


FIN-SYN-RST -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="FSR"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, SYN, RST] Seq=0 Win=8192 Len=0
  4   0.007679    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, SYN, RST] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with FIN-SYN-RST flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with FIN-SYN-RST flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

--------------------------------------------------------------

FIN-SYN-PSH -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="FSP"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0
  4   0.001930   10.0.0.100 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 80 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0
  7   0.006305    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with the FIN-SYN-PSH flags set, sent to LISTENING PORT , results in a RST-ACK

CentOS 6.5  - Packet with the FIN-SYN-PSH flags set, sent to a LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


FIN-SYN-PSH -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="FSP"),iface='eth0', count=1)
..
Sent 2 packets.


root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
 
6   4.623353    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0
  9   4.624532    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0
 10   4.624578   10.0.0.100 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 81 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0
 13   4.625571   10.0.0.101 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 81 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0

 


From the above:
Windows 2012 - Packet with the FIN-SYN-PSH flags set, sent to NON-LISTENING PORT, results in a RST-ACK

CentOS 6.5  - Packet with the FIN-SYN-PSH flags set, sent to NON-LISTENING PORT, results in a RST-ACK

--------------------------------------------------------------

FIN-SYN-ACK -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="FSA"),iface='eth0', count=1)
..
Sent 2 packets

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, SYN, ACK] Seq=0 Ack=0 Win=8192 Len=0
  4   0.001043   10.0.0.100 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0
  7   0.006517    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, SYN, ACK] Seq=0 Ack=0 Win=8192 Len=0
  8   0.006975   10.0.0.101 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the FIN-SYN-ACK flags set, sent to LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the FIN-SYN-ACK flags set, sent to LISTENING PORT, results in a RST


FIN-SYN-ACK -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="FSA"),iface='eth0', count=1)..
Sent 2 packets.


root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, SYN, ACK] Seq=0 Ack=0 Win=8192 Len=0
  4   0.002237   10.0.0.100 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0
  7   0.006692    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, SYN, ACK] Seq=0 Ack=0 Win=8192 Len=0
 10   0.008642   10.0.0.101 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the FIN-SYN-ACK flags set, sent to NON-LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the FIN-SYN-ACK flags set, sent to NON-LISTENING PORT, results in a RST

--------------------------------------------------------------

FIN-SYN-URG -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="FSU"),iface='eth0', count=1)
..
Sent 2 packets

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, SYN, URG] Seq=0 Win=8192 Urg=0 Len=0
  4   0.001772   10.0.0.100 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 80 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0
  7   0.005842    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, SYN, URG] Seq=0 Win=8192 Urg=0 Len=0


From the above:
Windows 2012 - Packet with the FIN-SYN-URG flags set, sent to LISTENING PORT , results in a RST-ACK

CentOS 6.5  - Packet with the FIN-SYN-URG flags set, sent to a LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


FIN-SYN-URG -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="FSU"),iface='eth0', count=1)
..
Sent 2 packets

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, SYN, URG] Seq=0 Win=8192 Urg=0 Len=0
  4   0.001999   10.0.0.100 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 81 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0
  7   0.006221    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, SYN, URG] Seq=0 Win=8192 Urg=0 Len=0
 10   0.008805   10.0.0.101 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 81 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0


From the above:
Windows 2012 - Packet with the FIN-SYN-URG flags set, sent to NON-LISTENING PORT, results in a RST-ACK

CentOS 6.5  - Packet with the FIN-SYN-URG flags set, sent to NON-LISTENING PORT, results in a RST-ACK

--------------------------------------------------------------

SYN-RST-PSH -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="SRP"),iface='eth0', count=1)
..
Sent 2 packets.


root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'   1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, RST, PSH] Seq=0 Win=8192 Len=0
  2   0.000941    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, RST, PSH] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with SYN-RST-PSH flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with SYN-RST-PSH flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


SYN-RST-PSH -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="SRP"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  7  10.501695    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, RST, PSH] Seq=0 Win=8192 Len=0
 10  10.511809    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, RST, PSH] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with SYN-RST-PSH flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with SYN-RST-PSH flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

--------------------------------------------------------------

SYN-RST-ACK -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="SRA"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0
  4   0.005815    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with SYN-RST-ACK flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with SYN-RST-ACK flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


SYN-RST-ACK -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="SRA"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0
  2   0.001433    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with SYN-RST-ACK flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with SYN-RST-ACK flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

--------------------------------------------------------------

SYN-RST-URG -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="SRU"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0
  4   0.006632    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0


From the above:
Windows 2012 - Packet with SYN-RST-URG flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with SYN-RST-URG flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


SYN-RST-URG -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="SRU"),iface='eth0', count=1)
..
Sent 2 packets.


root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0
  2   0.001376    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0


From the above:
Windows 2012 - Packet with SYN-RST-URG flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with SYN-RST-URG flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

--------------------------------------------------------------

PSH-RST-ACK -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="PRA"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  4   0.006336    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  4   0.006336    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with PSH-RST-ACK flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with PSH-RST-ACK flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


PSH-RST-ACK -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="PRA"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  4   9.148893    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  7   9.156663    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with PSH-RST-ACK flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with PSH-RST-ACK flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

--------------------------------------------------------------

PSH-ACK-SYN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="PAS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  3  15.616396    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  6  15.617127   10.0.0.100 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0
  9  15.623923    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
 12  15.624927   10.0.0.101 -> 10.0.0.50    TCP 60 80 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the PSH-ACK-SYN flags set, sent to LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the PSH-ACK-SYN flags set, sent to LISTENING PORT, results in a RST


PSH-ACK-SYN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="PAS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  4   0.001569    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  5   0.001735   10.0.0.100 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0
  6   0.002225   10.0.0.101 -> 10.0.0.50    TCP 60 81 > 5000 [RST] Seq=0 Win=0 Len=0


From the above:
Windows 2012 - Packet with the PSH-ACK-SYN flags set, sent to NON-LISTENING PORT, results in a RST

CentOS 6.5  - Packet with the PSH-ACK-SYN flags set, sent to NON-LISTENING PORT, results in a RST

--------------------------------------------------------------

PSH-FIN-SYN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="PFS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  3   4.267364    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0
  6   4.268165   10.0.0.100 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 80 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0
  7   4.268711    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0

 
From the above:
Windows 2012 - Packet with the PSH-FIN-SYN flags set, sent to LISTENING PORT , results in a RST-ACK

CentOS 6.5  - Packet with the PSH-FIN-SYN flags set, sent to a LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


PSH-FIN-SYN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="PFS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  5   1.651018    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0
  8   1.653316   10.0.0.100 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 81 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0
 11   1.660990    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, SYN, PSH] Seq=0 Win=8192 Len=0
 12   1.661332   10.0.0.101 -> 10.0.0.50    TCP 60 [TCP ACKed unseen segment] 81 > 5000 [RST, ACK] Seq=0 Ack=2 Win=0 Len=0


From the above:
Windows 2012 - Packet with the PSH-FIN-SYN flags set, sent to NON-LISTENING PORT, results in a RST-ACK

CentOS 6.5  - Packet with the PSH-FIN-SYN flags set, sent to NON-LISTENING PORT, results in a RST-ACK

--------------------------------------------------------------

PSH-RST-SYN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="PRS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  5   3.204299    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, RST, PSH] Seq=0 Win=8192 Len=0
  8   3.209791    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, RST, PSH] Seq=0 Win=8192 Len=0



From the above:
Windows 2012 - Packet with PSH-RST-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with PSH-RST-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


PSH-RST-SYN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="PRS"),iface='eth0', count=1)
..
Sent 2 packets.


root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, RST, PSH] Seq=0 Win=8192 Len=0
  2   0.001072    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, RST, PSH] Seq=0 Win=8192 Len=0



From the above:
Windows 2012 - Packet with PSH-RST-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with PSH-RST-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.  
 
--------------------------------------------------------------
   
RST-ACK-SYN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="RAS"),iface='eth0', count=1)
..
Sent 2 packets

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0
  2   0.001700    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with RST-ACK-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with RST-ACK-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.
 
 
RST-ACK-SYN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="RAS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0
  4   0.008154    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, RST, ACK] Seq=0 Ack=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with RST-ACK-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with RST-ACK-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

--------------------------------------------------------------

RST-FIN-SYN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="RFS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, SYN, RST] Seq=0 Win=8192 Len=0
  4   0.007232    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, SYN, RST] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with RST-FIN-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with RST-FIN-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


RST-FIN-SYN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="RFS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  3   3.343153    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, SYN, RST] Seq=0 Win=8192 Len=0
  4   3.344126    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, SYN, RST] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with RST-FIN-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with RST-FIN-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.
   
--------------------------------------------------------------

RST-URG-FIN -> Windows 2012/CentOS 6.5 -> 80 (Listening)

>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="RUF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  3   3.318014    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0
  4   3.319163    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0


From the above:
Windows 2012 - Packet with RST-URG-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with RST-URG-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet. 



RST-URG-FIN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="RUF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0
  4   0.005783    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, RST, URG] Seq=0 Win=8192 Urg=0 Len=0


From the above:
Windows 2012 - Packet with RST-URG-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with RST-URG-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet. 

--------------------------------------------------------------

RST-PSH-FIN -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="RPF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, RST, PSH] Seq=0 Win=8192 Len=0
  4   0.006418    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, RST, PSH] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with RST-PSH-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.


CentOS 6.5
  - Packet with RST-PSH-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet. 

 
RST-PSH-FIN -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="RPF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, RST, PSH] Seq=0 Win=8192 Len=0
  4   0.007311    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, RST, PSH] Seq=0 Win=8192 Len=0


From the above:
Windows 2012 - Packet with RST-PSH-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with RST-PSH-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet. 


If you wish to have this as a reference, you may download:
"Stimulus and Response.pdf" document.
md5:8c931888caf948504188f57440396ebc
sha-1:c4cb5b06928e660a09ddc7eaf4b7e32fb0dd1a27

stimulus-response.xlsx
MD5:6176b65c89b73e3b07a519bf77db462a
SHA-1:1ff6308e2a56a1c950e4cc5831932d78563bf853 

No comments:

Post a Comment