网络工程 - 如何使用 netcat 或类似工具模拟简单（类似 telnet）的网络协议 - 吾爱随笔录

我有一个条形码传感器 (Keyence SR-2000)，它能够使用简单的基于纯文本的协议。我可以使用提供的（仅限 Windows）应用程序 AutoID Terminal 和所交换的那 6 个数据包的包含的wireshark 转储与它交谈。有初始连接建立（据我所知），然后客户端发送LON\r（大概是激光）并且传感器返回5678\r（这是从传感器前面的条形码读取的值）。我也可以使用 Windows 下的 telnet 客户端（或 puttty 或 ncat）进行此连接。

当我echo -e 'LON\r' | nc 192.168.100.100 9004在 Linux 下尝试时（或只是通过打开连接nc），连接立即关闭。也就是说，我发送SYN但接收RST,ACK（而捕获的终端发送SYN和接收正常SYN,ACK）：

为什么不一样？下面是展开的剖析，也许有人可以告诉我如何制作连接建立，使客户端不会立即 RST？会不会是客户端使用了一些原始的os指纹来切断非windows客户端？

终端（工作通信）剖析：

      1 0.000000       192.168.100.2         192.168.100.100       TCP      66     49956 → 9004 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1

Frame 1: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
    Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
        Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
    Encapsulation type: Ethernet (1)
    Arrival Time: Sep 23, 2018 22:25:16.608835000 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1537734316.608835000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp]
    [Coloring Rule Name: TCP SYN/FIN]
    [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Dell_41:75:8e (d0:67:e5:41:75:8e), Dst: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
    Destination: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Dell_41:75:8e (d0:67:e5:41:75:8e)
        Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.2, Dst: 192.168.100.100
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 52
    Identification: 0x4366 (17254)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (6)
    Header checksum: 0x0000 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.100.2
    Destination: 192.168.100.100
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 49956, Dst Port: 9004, Seq: 0, Len: 0
    Source Port: 49956
    Destination Port: 9004
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgment number: 0
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x002 (SYN)
    Window size value: 64240
    [Calculated window size: 64240]
    Checksum: 0x49de [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
        TCP Option - Maximum segment size: 1460 bytes
            Kind: Maximum Segment Size (2)
            Length: 4
            MSS Value: 1460
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Window scale: 8 (multiply by 256)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 8
            [Multiplier: 256]
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - SACK permitted
            Kind: SACK Permitted (4)
            Length: 2

      2 0.000271       192.168.100.100       192.168.100.2         TCP      64     9004 → 49956 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 [ETHERNET FRAME CHECK SEQUENCE INCORRECT]

Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
    Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
        Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
    Encapsulation type: Ethernet (1)
    Arrival Time: Sep 23, 2018 22:25:16.609106000 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1537734316.609106000 seconds
    [Time delta from previous captured frame: 0.000271000 seconds]
    [Time delta from previous displayed frame: 0.000271000 seconds]
    [Time since reference or first frame: 0.000271000 seconds]
    Frame Number: 2
    Frame Length: 64 bytes (512 bits)
    Capture Length: 64 bytes (512 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp]
    [Coloring Rule Name: Checksum Errors]
    [Coloring Rule String [truncated]: eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" ||]
Ethernet II, Src: Keyence_2d:82:ba (00:01:fc:2d:82:ba), Dst: Dell_41:75:8e (d0:67:e5:41:75:8e)
    Destination: Dell_41:75:8e (d0:67:e5:41:75:8e)
        Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
    Padding: cb92
    Frame check sequence: 0x931fe00d incorrect, should be 0xfe3fcdd5
        [Expert Info (Error/Checksum): Bad checksum [should be 0xfe3fcdd5]]
            [Bad checksum [should be 0xfe3fcdd5]]
            [Severity level: Error]
            [Group: Checksum]
    [FCS Status: Bad]
Internet Protocol Version 4, Src: 192.168.100.100, Dst: 192.168.100.2
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 44
    Identification: 0x1a6c (6764)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 60
    Protocol: TCP (6)
    Header checksum: 0x1aa9 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.100.100
    Destination: 192.168.100.2
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 9004, Dst Port: 49956, Seq: 0, Ack: 1, Len: 0
    Source Port: 9004
    Destination Port: 49956
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgment number: 1    (relative ack number)
    0110 .... = Header Length: 24 bytes (6)
    Flags: 0x012 (SYN, ACK)
    Window size value: 5840
    [Calculated window size: 5840]
    Checksum: 0x5566 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (4 bytes), Maximum segment size
        TCP Option - Maximum segment size: 1460 bytes
            Kind: Maximum Segment Size (2)
            Length: 4
            MSS Value: 1460
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 1]
        [The RTT to ACK the segment was: 0.000271000 seconds]
        [iRTT: 0.000380000 seconds]

      3 0.000380       192.168.100.2         192.168.100.100       TCP      54     49956 → 9004 [ACK] Seq=1 Ack=1 Win=64240 Len=0

Frame 3: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0
    Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
        Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
    Encapsulation type: Ethernet (1)
    Arrival Time: Sep 23, 2018 22:25:16.609215000 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1537734316.609215000 seconds
    [Time delta from previous captured frame: 0.000109000 seconds]
    [Time delta from previous displayed frame: 0.000109000 seconds]
    [Time since reference or first frame: 0.000380000 seconds]
    Frame Number: 3
    Frame Length: 54 bytes (432 bits)
    Capture Length: 54 bytes (432 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp]
    [Coloring Rule Name: TCP]
    [Coloring Rule String: tcp]
Ethernet II, Src: Dell_41:75:8e (d0:67:e5:41:75:8e), Dst: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
    Destination: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Dell_41:75:8e (d0:67:e5:41:75:8e)
        Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.2, Dst: 192.168.100.100
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 40
    Identification: 0x4367 (17255)
    Flags: 0x02 (Don't Fragment)
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (6)
    Header checksum: 0x0000 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.100.2
    Destination: 192.168.100.100
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 49956, Dst Port: 9004, Seq: 1, Ack: 1, Len: 0
    Source Port: 49956
    Destination Port: 9004
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgment number: 1    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x010 (ACK)
    Window size value: 64240
    [Calculated window size: 64240]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x49d2 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2]
        [The RTT to ACK the segment was: 0.000109000 seconds]
        [iRTT: 0.000380000 seconds]

      4 1.435465       192.168.100.2         192.168.100.100       TCP      58     49956 → 9004 [PSH, ACK] Seq=1 Ack=1 Win=64240 Len=4

Frame 4: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
    Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
        Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
    Encapsulation type: Ethernet (1)
    Arrival Time: Sep 23, 2018 22:25:18.044300000 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1537734318.044300000 seconds
    [Time delta from previous captured frame: 1.435085000 seconds]
    [Time delta from previous displayed frame: 1.435085000 seconds]
    [Time since reference or first frame: 1.435465000 seconds]
    Frame Number: 4
    Frame Length: 58 bytes (464 bits)
    Capture Length: 58 bytes (464 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp:data]
    [Coloring Rule Name: TCP]
    [Coloring Rule String: tcp]
Ethernet II, Src: Dell_41:75:8e (d0:67:e5:41:75:8e), Dst: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
    Destination: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Dell_41:75:8e (d0:67:e5:41:75:8e)
        Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.2, Dst: 192.168.100.100
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 44
    Identification: 0x4368 (17256)
    Flags: 0x02 (Don't Fragment)
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (6)
    Header checksum: 0x0000 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.100.2
    Destination: 192.168.100.100
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 49956, Dst Port: 9004, Seq: 1, Ack: 1, Len: 4
    Source Port: 49956
    Destination Port: 9004
    [Stream index: 0]
    [TCP Segment Len: 4]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 5    (relative sequence number)]
    Acknowledgment number: 1    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Window size value: 64240
    [Calculated window size: 64240]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x49d6 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]
        [iRTT: 0.000380000 seconds]
        [Bytes in flight: 4]
        [Bytes sent since last PSH flag: 4]
    TCP payload (4 bytes)
Data (4 bytes)

0000  4c 4f 4e 0d                                       LON.
    Data: 4c4f4e0d
    [Length: 4]

      5 1.505160       192.168.100.100       192.168.100.2         TCP      64     9004 → 49956 [PSH, ACK] Seq=1 Ack=5 Win=5836 Len=5 [ETHERNET FRAME CHECK SEQUENCE INCORRECT]

Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
    Interface id: 0 (\Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121})
        Interface name: \Device\NPF_{9B1E160C-62A7-450A-AA5C-A48D7767E121}
    Encapsulation type: Ethernet (1)
    Arrival Time: Sep 23, 2018 22:25:18.113995000 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1537734318.113995000 seconds
    [Time delta from previous captured frame: 0.069695000 seconds]
    [Time delta from previous displayed frame: 0.069695000 seconds]
    [Time since reference or first frame: 1.505160000 seconds]
    Frame Number: 5
    Frame Length: 64 bytes (512 bits)
    Capture Length: 64 bytes (512 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp:data]
    [Coloring Rule Name: Checksum Errors]
    [Coloring Rule String [truncated]: eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" ||]
Ethernet II, Src: Keyence_2d:82:ba (00:01:fc:2d:82:ba), Dst: Dell_41:75:8e (d0:67:e5:41:75:8e)
    Destination: Dell_41:75:8e (d0:67:e5:41:75:8e)
        Address: Dell_41:75:8e (d0:67:e5:41:75:8e)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        Address: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
    Padding: 75
    Frame check sequence: 0x0c9736ac incorrect, should be 0xc47707cc
        [Expert Info (Error/Checksum): Bad checksum [should be 0xc47707cc]]
            [Bad checksum [should be 0xc47707cc]]
            [Severity level: Error]
            [Group: Checksum]
    [FCS Status: Bad]
Internet Protocol Version 4, Src: 192.168.100.100, Dst: 192.168.100.2
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 45
    Identification: 0x1a6d (6765)
    Flags: 0x00
    Fragment offset: 0
    Time to live: 60
    Protocol: TCP (6)
    Header checksum: 0x1aa7 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.100.100
    Destination: 192.168.100.2
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 9004, Dst Port: 49956, Seq: 1, Ack: 5, Len: 5
    Source Port: 9004
    Destination Port: 49956
    [Stream index: 0]
    [TCP Segment Len: 5]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 6    (relative sequence number)]
    Acknowledgment number: 5    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x018 (PSH, ACK)
    Window size value: 5836
    [Calculated window size: 5836]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0xf3a7 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 4]
        [The RTT to ACK the segment was: 0.069695000 seconds]
        [iRTT: 0.000380000 seconds]
        [Bytes in flight: 5]
        [Bytes sent since last PSH flag: 5]
    TCP payload (5 bytes)
Data (5 bytes)

0000  35 36 37 38 0d                                    5678.
    Data: 353637380d
    [Length: 5]

与 netcat dissection 通信失败：

No.     Time           Source                Destination           Protocol Length Info
      1 0.000000000    192.168.100.1         192.168.100.100       TCP      76     35464 → 9004 [SYN] Seq=0 Win=26880 Len=0 MSS=8960 SACK_PERM=1 TSval=2472528447 TSecr=0 WS=128

Frame 1: 76 bytes on wire (608 bits), 76 bytes captured (608 bits) on interface 0
    Interface id: 0 (any)
        Interface name: any
    Encapsulation type: Linux cooked-mode capture (25)
    Arrival Time: Sep 23, 2018 23:09:24.649574189 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1537736964.649574189 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 76 bytes (608 bits)
    Capture Length: 76 bytes (608 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: sll:ethertype:ip:tcp]
    [Coloring Rule Name: TCP SYN/FIN]
    [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Linux cooked capture
    Packet type: Sent by us (4)
    Link-layer address type: 1
    Link-layer address length: 6
    Source: AsustekC_da:88:12 (bc:ee:7b:da:88:12)
    Unused: 0000
    Protocol: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.100.1, Dst: 192.168.100.100
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 60
    Identification: 0x493d (18749)
    Flags: 0x02 (Don't Fragment)
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0xa7c8 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.100.1
    Destination: 192.168.100.100
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 35464, Dst Port: 9004, Seq: 0, Len: 0
    Source Port: 35464
    Destination Port: 9004
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgment number: 0
    1010 .... = Header Length: 40 bytes (10)
    Flags: 0x002 (SYN)
    Window size value: 26880
    [Calculated window size: 26880]
    Checksum: 0x49e5 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
        TCP Option - Maximum segment size: 8960 bytes
            Kind: Maximum Segment Size (2)
            Length: 4
            MSS Value: 8960
        TCP Option - SACK permitted
            Kind: SACK Permitted (4)
            Length: 2
        TCP Option - Timestamps: TSval 2472528447, TSecr 0
            Kind: Time Stamp Option (8)
            Length: 10
            Timestamp value: 2472528447
            Timestamp echo reply: 0
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Window scale: 7 (multiply by 128)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 7
            [Multiplier: 128]

No.     Time           Source                Destination           Protocol Length Info
      2 0.000210935    192.168.100.100       192.168.100.1         TCP      66     9004 → 35464 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

Frame 2: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
    Interface id: 0 (any)
        Interface name: any
    Encapsulation type: Linux cooked-mode capture (25)
    Arrival Time: Sep 23, 2018 23:09:24.649785124 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1537736964.649785124 seconds
    [Time delta from previous captured frame: 0.000210935 seconds]
    [Time delta from previous displayed frame: 0.000210935 seconds]
    [Time since reference or first frame: 0.000210935 seconds]
    Frame Number: 2
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: sll:ethertype:ip:tcp:vssmonitoring]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Linux cooked capture
    Packet type: Unicast to us (0)
    Link-layer address type: 1
    Link-layer address length: 6
    Source: Keyence_2d:82:ba (00:01:fc:2d:82:ba)
    Unused: 0000
    Protocol: IPv4 (0x0800)
    Padding: 35363738
Internet Protocol Version 4, Src: 192.168.100.100, Dst: 192.168.100.1
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 40
    Identification: 0x1aa4 (6820)
    Flags: 0x00
    Fragment offset: 0
    Time to live: 60
    Protocol: TCP (6)
    Header checksum: 0x1a76 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.100.100
    Destination: 192.168.100.1
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 9004, Dst Port: 35464, Seq: 1, Ack: 1, Len: 0
    Source Port: 9004
    Destination Port: 35464
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgment number: 1    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x014 (RST, ACK)
    Window size value: 0
    [Calculated window size: 0]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0xfff0 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 1]
        [The RTT to ACK the segment was: 0.000210935 seconds]
        [iRTT: 0.000210935 seconds]
VSS-Monitoring ethernet trailer, Source Port: 3412
    Src Port: 3412