attempting to troubleshoot for customer

Apr 02, 2007 0 Replies

This little poor thing looks just odd. When you take a closer look, you will see that port numbers and other TCP parameters of this packet are actually... constructed of what should be the packet payload! Source port and destination port, two 2-byte values that start every TCP header, are



18245 and 28261 - 0x4745, 0x5420 in network endian order. This translates to ASCII string 'GET ', a beginning of a HTTP request. This kid has lost its TCP header, but IP header (with protocol type set to TCP) and TCP payload are still there... We started to see thousands of packets just like this one somewhere in the middle of 2000, coming from many locations in Poland. After some time, we realized that all were generated by a badly broken Nortel CVX access servers deployed country-wide by the Polish Telecom. Firmware was fixed within a month or so, but this priceless packet dump will live forever.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required