0

I use tcpdmp to capture packages between my client and server communications with the command

tcpdump -i eth0 -v port 8113 

The output contains many packages like the following:

******* IP (tos 0x0, ttl 64, id 14510, offset 0, flags [DF], proto TCP (6), length 40)
    *******.8113 > ********.27853: Flags [.], cksum 0x6750 (correct), ack 32, win 23, length 0

So what these empty packages without any flags for?

1 Answer 1

1

TCP packets without any flags are malformed by RFC 793. These segments can be used for discovering of closed ports. TCP segments with wrong flags should be dropped by an open port and should be answered with RST if a port is closed. It called "TCP Null Scan". See here for details.

1
  • Is this the only possible explanation?
    – George
    Nov 18, 2013 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.