[Bro-Dev] #285: unsolicited SYN|ACK leads to Event(connection_established) in TCP.cc

[Bro Tracker]

#285: unsolicited SYN|ACK leads to Event(connection_established) in TCP.cc
--------------------------------+-------------------------------------------
 Reporter:  hartley.87@…        |       Type:  Problem
   Status:  new                 |   Priority:  Normal 
Component:  Bro                 |    Version:  1.5.1  
 Keywords:                      |  
--------------------------------+-------------------------------------------

Comment(by hartley.87@…):

 The sequence numbers are not 0, I was too quick in looking at that.  It
 seems reasonable to make this a half-open
 connection, hoping for a late-arriving (because of load-balancing,
 whatever) reverse (corresponding) SYN, and
 that's probably what's happening...

-- 
Ticket URL: <http://tracker.icir.org/bro/ticket/285#comment:1>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker