Server generates SYN-ACK in response to Scapy SYN, but doesn't generate in response to other SYNs

0

I have virtual machine with Ubuntu 18.04.5 LTS which has Python simple HTTP server. This VM has two interfaces: incoming one (enp0s8) with IPIP-tunnel (mytun) and outcoming one (enp0s9). Also there's interface to host communication (enp0s3). VM must generates SYN-ACK in response to SYN received from incoming interface and sends it via outcoming interface by default gateway route.

This is VM scheme. There are two cases:

  1. If I send SYN by Scapy, VM generates SYN-ACK:
    Scapy SYN wireshark dump
from scapy.all import *
import random

sport = random.randint(1024, 65535)
SYN = IP(src='192.168.0.2', dst='192.168.0.1') / \
      IP(src='10.0.0.1', dst='10.0.0.2') / \
      TCP(sport=sport, dport=80, seq=random.randint(0, int('0xFFFFFFFF', 16)), flags="S")

send(SYN)
  1. If I use something else, for example, curl, VM doesn't generate SYN-ACK:
    curl SYN wireshark dump

These SYNs differ only by TCP options. Also attach information about interfaces, routes, tunnels and sockets.

kndrvt@kndrvt-VM:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.0.0.2/32 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:88:b9:65 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.4/24 brd 192.168.2.255 scope global dynamic noprefixroute enp0s3
       valid_lft 409sec preferred_lft 409sec
    inet6 fe80::5249:f93e:44a8:9c3/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:ec:7c:b7 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.1/30 scope global enp0s8
       valid_lft forever preferred_lft forever
4: enp0s9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:6f:63:ab brd ff:ff:ff:ff:ff:ff
    inet 172.16.0.3/30 scope global enp0s9
       valid_lft forever preferred_lft forever
5: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
6: mytun@enp0s8: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state UNKNOWN group default qlen 1000
    link/ipip 192.168.0.1 peer 192.168.0.2
    inet6 fe80::5efe:c0a8:1/64 scope link 
       valid_lft forever preferred_lft forever

kndrvt@kndrvt-VM:~$ ip r
default via 172.16.0.1 dev enp0s9 
169.254.0.0/16 dev enp0s3 scope link metric 1000 
172.16.0.0/30 dev enp0s9 proto kernel scope link src 172.16.0.3 
192.168.0.0/30 dev enp0s8 proto kernel scope link src 192.168.0.1 
192.168.2.0/24 dev enp0s3 proto kernel scope link src 192.168.2.4 metric 100 

kndrvt@kndrvt-VM:~$ ip t
tunl0: any/ip remote any local any ttl inherit nopmtudisc
mytun: ip/ip remote 192.168.0.2 local 192.168.0.1 dev enp0s8 ttl inherit

kndrvt@kndrvt-VM:~$ ss -t -a
State           Recv-Q           Send-Q                       Local Address:Port                         Peer Address:Port           
LISTEN          0                5                                 10.0.0.2:http                              0.0.0.0:*              
LISTEN          0                128                          127.0.0.53%lo:domain                            0.0.0.0:*              
LISTEN          0                5                                127.0.0.1:ipp                               0.0.0.0:*              
LISTEN          0                5                                    [::1]:ipp                                  [::]:*              

I launched HTTP server by the following command:

python3 -m http.server 80 --bind 10.0.0.2

Iptables are empty. I don't know the reason of such behavior. Hope for your help.

linux
networking
tcp
scapy
tcpserver
asked on Stack Overflow May 21, 2021 by Lev Pantyukhin • edited May 21, 2021 by Lev Pantyukhin

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0