title: 3 way handshake in Scapy
body: <p>Im trying to build a 3 way handshake in Scapy. Using the following code,</p>
  
  <pre><code>#!/usr/local/bin/python
  
  from scapy.all import *
  
  sport = random.randint(1024,65535)
  
  # SYN     
  ip=IP(src='172.16.120.5',dst='172.16.100.101')
  SYN=TCP(sport=sport,dport=443,flags='S',seq=1000)
  SYNACK=sr1(ip/SYN)
  
  # ACK              
  my_ack = SYNACK.seq + 1
  ACK=TCP(sport=sport, dport=443, flags='A', seq=1001, ack=my_ack)
  send(ip/ACK)
  </code></pre>
  
  <p>However on the server I see only SYN_RECV even though the return SYN-ACK is sent and the ACK is sent in return. Here is a capture from the server (172.16.100.101),</p>
  
  <pre><code>08:10:19.455038 IP 172.16.120.5.58972 &gt; 172.16.100.101.https: S 1000:1000(0) win 8192
  08:10:19.455343 IP 172.16.100.101.https &gt; 172.16.120.5.58972: S 2541678705:2541678705(0) ack 1001 win 18484 &lt;mss 1460&gt;
  08:10:19.545808 IP 172.16.120.5.58972 &gt; 172.16.100.101.https: . ack 1 win 8192
  08:10:24.015204 IP 172.16.100.101.https &gt; 172.16.120.5.58972: S 2541678705:2541678705(0) ack 1001 win 18484 &lt;mss 1460&gt;
  </code></pre>
  
  <p>As you can see the SYN-ACK is being sent twice so it looks like the server doesnt like the final ACK. Any ideas ?</p>
  
  <p>EDIT :</p>
  
  <p>Ive also printed the output of each of the packets directly from python. Note this was for a different connection. </p>
  
  <pre><code>&gt;&gt;&gt; SYN
  &lt;TCP  sport=26193 dport=https seq=1000 flags=S |&gt;
  &gt;&gt;&gt; 
  &gt;&gt;&gt; SYNACK
  &lt;IP  version=4L ihl=5L tos=0x0 len=44 id=0 flags=DF frag=0L ttl=63 proto=tcp chksum=0x741 src=172.16.100.101 dst=172.16.120.5 options=[] |&lt;TCP  sport=https dport=26193 seq=1023579974 ack=1001 dataofs=6L reserved=0L flags=SA window=18484 chksum=0xdb18 urgptr=0 options=[('MSS', 1460)] |&lt;Padding  load='\x00\x00' |&gt;&gt;&gt;
  &gt;&gt;&gt; 
  &gt;&gt;&gt; ACK
  &lt;TCP  sport=26193 dport=https seq=1001 ack=1023579975 flags=A |&gt;
  </code></pre>
  
  <p>EDIT 2 :</p>
  
  <p>Below shows a successful and unsucessful connection.</p>
  
  <p><strong>SCAPY</strong></p>
  
  <pre><code>20:58:37.357056 IP 172.16.120.5.35957 &gt; 172.16.100.101.https: S 10:10(0) win 8192
  20:58:37.357369 IP 172.16.100.101.https &gt; 172.16.120.5.35957: S 900629853:900629853(0) ack 11 win 18484 &lt;mss 1460&gt;
  20:58:37.445888 IP 172.16.120.5.35957 &gt; 172.16.100.101.https: . ack 900629854 win 8192
  </code></pre>
  
  <p><strong>CURL</strong> </p>
  
  <pre><code>20:58:46.165413 IP 172.16.120.5.33241 &gt; 172.16.100.101.https: S 2266708589:2266708589(0) win 5840 &lt;mss 1460,sackOK,timestamp 17370497 0,nop,wscale 6&gt;
  20:58:46.166296 IP 172.16.100.101.https &gt; 172.16.120.5.33241: S 2138155488:2138155488(0) ack 2266708590 win 18460 &lt;mss 1460,sackOK,timestamp 107550664 17370497,nop,wscale 7&gt;
  20:58:46.169026 IP 172.16.120.5.33241 &gt; 172.16.100.101.https: . ack 2138155489 win 92 &lt;nop,nop,timestamp 17370497 107550664&gt;
  </code></pre>