full-disclosure - Odd packet?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: full-disclosure at nym.hush.com (full-disclosure@....hush.com)
Subject: Odd packet?

>Ok.  It seems the case described.  A spoofed packet with your 
>IP as the source tries to connect to the compromised machine 
>to port 80 at localhost.  The compromised machine doesn't have a
>webserver listening at 127.0.0.1:80 so the tcp stack replyes 
>ACK RST and sends this packet to your spoofed address.

Unlikely.  If this were the case, the server would reply with RST, not
RST, ACK.  There's too little information to come to any conclusion at
this point.