Hello, I have pcap file recorded by tcpdump. Giving it to ntop as input gives among other things, an open ports list for every host. Looking with ethereal at the same file , I can't really understand why ntop recognized the port as open since the client sent SYN packet , and the answer from the server was [RST,ACK]. According to my knowledge, this happens at the handshake process in TCP when there is no process listening on the required port. What am I missing , that ntop haven't ? Why to me the port looks close and ntop says the port is open? Regards, Sharon.
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
