mirror of
https://github.com/adulau/ssldump.git
synced 2024-11-24 10:27:05 +00:00
36d81fabcb
I have pcaps from Cisco2960 span port and found some tcp handshake has weird order 3-way handshake. It seems first packet order between sessions is not guaranted for cisco span. maybe. Current state transition is INIT -- syn --> SYN1 -- syn&ack --> SYN2 -- ack --> ESTABLISHED New state transition starts with SYN1 or SYN2 and adds(revive actually) STATE_ACK to handle both cases. case1 : INIT -- syn --> SYN1 -- syn&ack -->ACK -- ack --> ESTABLISHED (normal) case2 : INIT -- syn&ack --> SYN2 -- syn -->ACK -- ack --> ESTABLISHED (weird) |
||
---|---|---|
.. | ||
common.c | ||
debug.c | ||
debug.h | ||
network.c | ||
network.h | ||
pcap-snoop.c | ||
print_utils.c | ||
print_utils.h | ||
proto_mod.c | ||
proto_mod.h | ||
targets.mk | ||
tcpconn.c | ||
tcpconn.h | ||
tcppack.c | ||
tcppack.h |