Re: [Full-disclosure] Reverse engineering the Windows TCP stack

["Nicolas RUFF (lists)" <ruff.lists@xxxxxxxxxx>]

>>>Hey, I am looking for Windows TCP/IP stack information, I
>>>would like to know why it behaves inconsistently to SYN|FIN|URG|PSH!
> I'm curious about this one too...can you guys keep the replies on the
list?

Well, at least when you try to connect to a closed port, Windows retries
several times (SYN) even when RST has been received. My Linux don't.

-> "telnet <non firewalled ip> <closed port>" while running Ethereal.

However I am not sure whereas it is the TCP/IP stack or the Winsock
layer that induces this behaviour.

TCP/IP fingerprinting relies on such oddities, I guess a little Googling
would help.

Regards,
- Nicolas RUFF
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/