tcp - Listening Application (winsock2) behavior towards Port scanning (Syn Scan) -

should server application listens on port, able detect , logs down connection attempt done syn scanning?

test scenario

i had written windows program called "simpleserver.exe". program simulation of basic server application. listens on port, , wait incoming messages. listening socket defined tcp stream socket. that's program doing.

i had been deploying exact same program on 2 different machines, both running on windows 7 professional 64bit. machine act host. , stationed in same network area.

then, using program "nmap", used machine on same network, act client. using "-ss" parameter on "nmap", syn scan, ip , port of listening simpleserver on both machine (one attempt @ time).

(note 2 hosts had "wireshark" started, , monitoring on tcp packets client's ip , listening port.)

in "wireshark" entry, on both machine, saw expected tcp packet syn scan:

client ----(syn)----> host  client <--(syn/ack)-- host  client ----(rst)----> host 

the above packet exchange suggests connection not established.

but on "simpleserver.exe", 1 of had "new incoming connection" printed in logs, while other instance not alerted of new incoming connection, hence no logs @ all.

code snippets

// socket bind , listen done above loop  while(true) {     sclient=accept(slisten,(sockaddr*)&remoteaddr,&naddrlen);     if(sclient == invalid_socket)     {         printf("failed accept()");         continue;     }     dwsockopt (slisten);     printf ("recv connection: %s\n", inet_ntoa(remoteaddr.sin_addr));      closesocket(sclient); } 

side note: yes, since simple program, flow might little funny, such no break in while loop. please don't mind simple , flawed design.

further investigation

i had put getsockopt() in "simpleserver" right after went listening state, check differences of both listening socket's sol_socket option.

one notable difference found between 2 hosts, so_max_msg_size. host detects incoming connection has hex value of 0x3fffffff (1073741823), while other 1 has no logs 0xffffffff (-1). not sure if related or not, spammed whatever differences may found in test environment. other value of sol_socket more or less same.

side note: tested on other machine, covers windows 7 professional, windows server 2008 r2, windows server 2003. not sure if coincidence or not, machine have so_max_msg_size == -1, did not detect connection of syn scanning. maybe coincidence. have nothing prove tho.

help needed

• why different behavior 2 same of same application on different machine same os?
• what determines value of so_max_msg_size? considering 2 same os having 2 different values.

if connection never established, accept() never return. disposes of 90% of question.

the explanation 'new incoming connection' (or 'recv connection' or whatever is) message else connected.

so_max_msg_size has no meaning tcp socket, let alone listening tcp socket. whatever variation experienced meaningless.