# Strange Packet (invert ip) **URL:** \ **Category:** Zeek\ **Created:** [September 20, 2004, 5:51am UTC](https://community.zeek.org/t/strange-packet-invert-ip/589 "2004-09-20T05:51:45Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [September 20, 2004, 5:51am UTC](https://community.zeek.org/t/strange-packet-invert-ip/589/1 "2004-09-20T05:51:45Z")
> length: 40) 211.91.135.39.80 \> x.x.x.x.52510: S [tcp sum ok] > ... > 1095628174.157850 WeirdActivity > bad\_TCP\_header\_len x.x.x.x/52510 \> 211.91.135.39/80 > ... > and why bro use bad tcp port ? Now I understand the question. The original packet was a SYN ACK from 211.91.135.39/80 to x.x.x.x/52510, but Bro reports it in the opposite order. The reason for this (which I agree is not intuitive) is that because the packet was a SYN ACK, Bro instantiates a corresponding connection in the opposite direction (because presumably x.x.x.x sent an initial SYN using source port 52510). Bro's current "weird" framework (which needs to be reworked) always identifies the connection rather than the culprit, so if the sender of something strange was the apparent server side, it comes out looking instead like it came from the apparent client side.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/strange-packet-invert-ip/589/2 "2022-05-06T15:37:10Z")
Closed on May 6, 2022, 3:37pm UTC