On Thu, 14 Apr 2005 15:04:54 -0000, pv+usenet@pobox.com (Paul Vader)
wrote:

>Steve Baker <bakesph@comcast.net> writes:
>>>It's not sending a syn by itself - more likely it's trying to open a socket,
>>>and you see 'SYN SENT' in netstat because the other end isn't up.
>>
>> What's the difference between "sending a SYN" and "trying to open a
>>socket"?
>
>You can do the first without any intention of ever doing the second. See
>'syn flooding' for example. When you see "SYN SENT" on a netstat, unless it
>appears and disappears, it's almost certainly because a process is trying to
>open a socket, and the TCP stack is waiting for an SYN ACK before returning
>a socket pointer to the process. *

I see what you mean now. I was misunderstanding the "syn by itself"
part, thinking that the "by itself" part referred to the browser, not
the packet.

Steve Baker