full-disclosure - Reverse engineering the Windows TCP stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Mar 31 19:02:59 2005
From: ruff.lists at edelweb.fr (Nicolas RUFF (lists))
Subject: Reverse engineering the Windows TCP stack

>>>Hey, I am looking for Windows TCP/IP stack information, I
>>>would like to know why it behaves inconsistently to SYN|FIN|URG|PSH!
> I'm curious about this one too...can you guys keep the replies on the
list?

Well, at least when you try to connect to a closed port, Windows retries
several times (SYN) even when RST has been received. My Linux don't.

-> "telnet <non firewalled ip> <closed port>" while running Ethereal.

However I am not sure whereas it is the TCP/IP stack or the Winsock
layer that induces this behaviour.

TCP/IP fingerprinting relies on such oddities, I guess a little Googling
would help.

Regards,
- Nicolas RUFF