GSEC · Question #6
Which of the following TCP dump output lines indicates the first step in the TCP 3-way handshake?
The correct answer is A. 07:09:43.368615 download.net 39904 > ftp.com.21: S. The first step of the TCP 3-way handshake is the client sending a SYN segment to the server, identifiable in tcpdump output by the 'S' flag originating from the client side.
Question
Which of the following TCP dump output lines indicates the first step in the TCP 3-way handshake?
Options
- A07:09:43.368615 download.net 39904 > ftp.com.21: S
- B07:09:43.370302 ftp.com.21 > download.net.39904: S
- C09:09:22.346383 ftp.com.21 > download.net.39904: , rst 1 win 2440(DF)
- D07:09:43.370355 download.net.39904 > ftp.com.21: , ack 1 win 8760 (DF)
How the community answered
(30 responses)- A70% (21)
- B10% (3)
- C3% (1)
- D17% (5)
Why each option
The first step of the TCP 3-way handshake is the client sending a SYN segment to the server, identifiable in tcpdump output by the 'S' flag originating from the client side.
This line shows the client (download.net port 39904) transmitting to the server (ftp.com port 21) with only the 'S' (SYN) flag set, which is the connection initiation step of the TCP 3-way handshake. The client chooses this sequence to signal it wants to establish a connection and advertises its initial sequence number. The source being the client and the lone SYN flag confirms this is step one of the handshake.
This shows the server (ftp.com) responding with a SYN-ACK back to the client, which is the second step of the handshake, not the first.
This shows a RST (reset) flag from the server, indicating a connection reset or refusal - not a handshake initiation.
This shows the client sending an ACK to the server, which is the third and final step of the TCP 3-way handshake.
Concept tested: TCP 3-way handshake SYN identification in tcpdump
Source: https://www.rfc-editor.org/rfc/rfc793
Topics
Community Discussion
No community discussion yet for this question.