Hack Security Pro.pdf - Index of

We will simultaneously launch the packets emissions for a better analysis of results.
First terminal; emission of spoofed packets to server S.
Here, C asks for connections to S. The ID is incremented of +1 at each sending.
Second terminal: emission of TCP/IP packets to client C.
Let us have a look at the same time at what is on our second terminal, the only one of interest here.
We notice that the packets' ids are all incremented of +1, but from the 3 rd onwards, the increment is
doubled (+2). The ID is doubled during the emission of 6 packets, and exactly 6 packets had already
been emitted (see bottom of the previous capture). What can the conclusion be? As the ID has
doubled, it can only mean one thing: 8 packets have been emitted by C but they were not destined to
A, hence the increment jump from +256 to +512. What were these packets? If you refer to the
previous chapter, these were obviously packets going from C to S with the RST flag active. But why is
that? It is because C has never itself requested a connection. So it informs S with each packet with a
Syn / Ack that it receives that this is an error.
The Hackademy DMP -87/209- SYSDREAM