24 Jul
2014
24 Jul
'14
3:08 p.m.
On Thu, 24 Jul 2014 14:33:56 -0400, Zach Hill said:
First is the SYN from Server A to Server B http://i.imgur.com/E5cu4ev.png
Was this captured with tcpdump on Server A on its way out, or on Server B on its way in, or at some other point using a span port? The answer matters if we're suspecting that something along the way is stomping the option....