• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3491
  • Last Modified:

TCP/IP: 3-way Handshake

Hello Experts,

I have a question regarding the 3-way tcp handshake.  Where does the fault lies when the sender does not send back an ACK?  This is the situation that I am currently getting.  We have two sender, A and B.  

A --> B     [SYN]
B --> A     [SYN, ACK]
A --> B     No response

Does this mean that A did not get the [SYN, ACK] from the second phase of the handshake?  Or did "A" block the third phase?  Can someone clarify this for me.  As always, thank you for your time on this matter...it is always appreciated.
0
coperator
Asked:
coperator
  • 2
  • 2
2 Solutions
 
RGRodgersCommented:
A should either ACK (called a SYN ACK ACK) or a NACK for either a bad message or timeout if A gets nothing from B.  A appears at fault.
0
 
skaap2kCommented:
There could be a issue where one of these devices is using TCP SYN Cookies and the other does not know how to handle it (unlikely)

The best way to find out what is going on, is to take a Ethereal/Wireshark trace from both devices, and see whether A is indeed receiving the SYN ACK, and if it is sending the ACK/SYNACKACK to B ..

RN
0
 
RGRodgersCommented:
All true, especially the Wireshark comment.  

However, whether A knew how to handle it or not, or received the ACK or not, A was obligated to respond with a SYN/ACK/ACK or a NACK.  No response is never correct.

But, do the trace and tell us what you see!  Thanks...
0
 
coperatorAuthor Commented:
Unfortunately, I have no control of the other device.  It belongs to a client.  One thing I'd like to mention is the physical layout and where I was able to do a tcpdump.  Will call the client router A and my PIX B (OUTSIDE interface) and both are interconnected thru a switch C.

A -> C -> B

I was able to do a tcpdump from C.  I discovered that there was a Linux box setup to sniff and the port was configured for spanning.  So, that's were I was able to capture the packets.  Now, base on what I had described above, it seems that it is leaving my OUTSIDE interface of my PIX but I am not able to get an ACK from A.  Base on the conversation above, does this confirm that A is at fault?

As always, thank you for your time on this matter.
0
 
skaap2kCommented:
More than likely, yes, that would be the issue.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now