1

This might be a general TCP question.

Can I receive TCP SYN packet on an ESTABLISHED connection OR a connection in TIME-WAIT state?

Is this possible?

StackzOfZtuff
  • 1,842
  • 13
  • 21
hari
  • 270
  • 1
  • 4
  • 17

2 Answers2

2

A SYN received on an ESTABLISHED TCP connection should not be happening. It could be a delayed packet, which it would be safe to silently drop.

It is possible to end up with the server in ESTABLISHED state and client in CLOSED state if the connection is lost and is timed out on the client and not on the server, or if the client is restarted. Attempting to open a new connection in this scenario would cause a SYN packet to be received in ESTABLISHED state. The desired outcome is that the old connection is closed and a new is opened.

The way this desired outcome is achieved is as follows:

  • Client sends a SYN to create a new connection.
  • Server send an ACK for the ESTABLISHED connection.
  • Client responds to the ACK with a RST packet causing the ESTABLISHED connection to go away.
  • Client retransmits SYN packet to create a new connection.

A SYN packet received in TIME_WAIT state can happen after the server has closed the connection, and the client opens a new connection with same port numbers. This will cause a new connection to be opened.

kasperd
  • 30,455
  • 17
  • 76
  • 124
  • Awesome. This looks like what I am looking for. I'd go back and try to trace this down in kernel code - just to be sure :-) – hari Jun 24 '14 at 19:07
0

Neither...SYN is only used when the connection is first set up (the three-way handshake) or when the packet is destroyed.

Basically:

SYN (I want to start a connection) -> ACK/SYN (OK, I want to start a connection too) -> ACK (acknowledged connection, ready for data)

Conversation flows with ACK packets sent by both hosts indicated they recieved each others packets.

At the end, FIN is sent to the server and TIME_WAIT is set on the socket. When the server responds with a FIN packet, the socket is released.

Nathan C
  • 15,059
  • 4
  • 43
  • 62
  • Do you mean only when a socket is in LISTEN state? – hari Jun 24 '14 at 19:03
  • `LISTEN` has nothing to do with the flags. A `LISTEN` state is a software state saying "socket is waiting for connections" and tells the OS to wait for packets on the port. A `SYN` from a remote client to the socket gets it started. – Nathan C Jun 24 '14 at 19:04
  • Are you saying the threeway handshake is SYN -> SYN/ACK -> SYN? Because it isn't. – Mark Wagner Jun 24 '14 at 19:22
  • Sorry, last part is an `ACK`...adjusted. – Nathan C Jun 24 '14 at 19:24