1

I am trying to do a handshake with a server I downloaded from the internet. But when the client receives [SYN, ACK] it sends back a [RST]. Have no idea what is happening. Already checked the acknowledge and sequence number but everything seems ok.

In wireshark I got this:

enter image description here

Here is the handshake client source code:

from scapy.all import *

src_ip   = "192.168.43.34"
dst_ip   = "192.168.43.115"
src_port = random.randint(1024, 65535)
dst_port = 502

seq_nr   = random.randint(444, 8765432)
ack_nr   = 0



# Create SYN packet
ip       = IP (src   = src_ip, dst = dst_ip)
syn      = TCP(sport = src_port, dport = dst_port, flags='S', seq = seq_nr, ack = ack_nr)
pkt_syn  = ip / syn 

pkt_syn.show()

# send SYN packet and receive SYN/ACK packet
print('Sending SYN')
pkt_syn_ack = sr1(pkt_syn)
print('ACK received')
pkt_syn_ack.show()


# Create the ACK packet
ack_nr   = pkt_syn_ack.seq + 1
seq_nr   = seq_nr + 1

ack = TCP(sport = src_port, dport = dst_port, flags = 'A', seq = seq_nr, ack = ack_nr)
send(ip / ack)

...
user72726
  • 155
  • 1
  • 6

1 Answers1

3

The problem is that your OS is receiving the SYN-ACK packet, has no idea why it was sent (as the OS itself didn't start a handshake) and reset the connection.

You can find some solutions here (for Linux)- Unwanted RST TCP packet with Scapy

Another option is to use a different IP than the OS's, or in Windows turn off the IP stack of the used interface (only if this is the only thing that you use this interface for!)

Shir
  • 1,157
  • 13
  • 35
  • 1
    This is also mentioned in Scapy's FAQ: https://scapy.readthedocs.io/en/latest/troubleshooting.html#my-tcp-connections-are-reset-by-scapy-or-by-my-kernel – Cukic0d Jan 06 '20 at 14:38
  • Thank you! Now I am facing another problem. After handshake, when receiving a package from the sever, the kernel (I think) sends back an ICMP. I don't know if these two problems are related. https://pasteboard.co/IOKXmzX.png – user72726 Jan 06 '20 at 19:56
  • If you used the first solution in the link (dropping reset packets), I think using the second one (dropping all packets to the Scapy port) should help with the ICMP too – Shir Jan 07 '20 at 07:56