Has anyone seen a server change the dest port on a syn-ack?

retag add tags

syn comes in port src 27373 dst 1445. syn-ack uses ports src 1445 dst 14019

[email protected]

asked 2022-09-27 16:48:10 +0000

edit flag offensive 0 remove flag close merge delete

Comments

Could be a NAPT going wrong.

Jaap (2022-09-28 06:26:04 +0000) edit

I found that the source server uses an F5 LB as a default gateway

[email protected] (2022-09-28 12:58:49 +0000) edit

Sounds suspiciously like a misconfiguration in the F5.

hugo.vanderkooij (2022-09-29 10:10:11 +0000) edit

add a comment see more comments

Be the first one to answer this question!

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Has anyone seen a server change the dest port on a syn-ack? edit

Comments

Be the first one to answer this question!

Has anyone seen a server change the dest port on a syn-ack?