I have a port forwarding rule sending 23 traffic to a "honeypot" (called "comp" below). Throughout the night, many bots from around the world attempted to connect, but there was no service running.
Now, I wrote a C program that just binds to 23, accepts a connection, and exits. When a bot scans, Wireshark shows the following failed handshake for most connection attempts:
bot --> comp (SYN, port 23) comp --> bot (SYN, ACK) (sometimes): comp --> bot (TCP retransmission) ... (may have several retransmissions) bot --> comp (RST) (sometimes happens immediately after the SYN, ACK)
I have seen one successful bot connection, but most attempts result in the above. I know that the program is working because when I telnet with my Android on 4G (i.e. outside the LAN), the normal three-way handshake occurs, followed by an immediate FIN, ACK from my "honeypot", as expected.
Why do many of the bot connection attempts fail? The bots can't possibly tell that it's not a real telnet service before they even finish connecting?
Edit: Also, they sometimes send another SYN immediately after the RST, and then that handshake proceeds successfully.