RAW TCP connection issues

Hi! I try to connect to the socket of the device (cashless terminal). To connect, it uses TCP protocol on 62801 port. I am successfully connecting from a Linux machine, but for some reason the application does not respond to the SYN packet from the freertos. I am attaching a log and a screenshot of the package capture program from Linux and freertos

 FreeRTOS_connect: 35846 to c0a8586cip:62801
 [11:45:07:143] < Socket 35846 -> [192.168.88.108]:62801 State eCLOSED->eCONNECT_SYN
 [11:45:07:143] < ARP c0a8586cip miss using c0a8586cip
 [11:45:07:143] < ARP for c0a8586cip (using c0a8586cip): rc=0 00-00-00-00-00-00
 [11:45:07:143] < Connect[c0a8586cip:62801]: pxEasyFit: ARP c0a8586dip -> c0a8586cip
 [11:45:07:143] < next timeout 1: 500 ms
 [11:45:07:143] < ipARP_REPLY from c0a8586cip to c0a8586dip end-point c0a8586dip
 [11:45:07:644] < prvSocketSetMSS: 1460 bytes for c0a8586cip port 62801
 [11:45:07:644] < prvWinScaleFactor: uxRxWinSize 1 MSS 1460 Factor 0
 [11:45:07:644] < CHeap: current 54104 lowest 53992
 [11:45:07:644] < onnect[c0a8586cip:62801]: next timeout 1: 3000 ms
 [11:45:10:654] < prvWinScaleFactor: uxRxWinSize 1 MSS 1460 Factor 0
 [11:45:10:654] < Connect[c0a8586cip:62801]: next timeout 2: 6000 ms
 [11:45:16:638] < prvWinScaleFactor: uxRxWinSize 1 MSS 1460 Factor 0
 [11:45:16:638] < Connect[c0a8586cip:62801]: next timeout 3: 11000 ms
 [11:45:17:142] < FreeRTOS_FindEndPointOnNetMask[12]: No match for a0a0a01ip
 [11:45:21:924] < pxEasyFit: ARP c0a85801ip -> c0a8586dip
 [11:45:21:924] < ipARP_REQUEST from c0a85801ip to c0a8586dip end-point c0a8586dip
 [11:45:22:155] < FreeRTOS_closesocket[0ip port 35846 to c0a8586cip port 62801]: buffers 56 socks 0
 [11:45:22:155] < Cant open connection
 [11:45:22:155] < status 2
 [11:45:22:155] < Open connection to addr 192.168.88.108
 [11:45:22:155] < 
 [11:45:22:155] < FreeRTOS_connect: 52540 to c0a8586cip:62801
 [11:45:22:155] < Socket 52540 -> [192.168.88.108]:62801 State eCLOSED->eCONNECT_SYN
 [11:45:22:155] < prvSocketSetMSS: 1460 bytes for c0a8586cip port 62801
 [11:45:22:155] < prvWinScaleFactor: uxRxWinSize 1 MSS 1460 Factor 0
 [11:45:22:155] < CHeap: current 33096 lowest 32984
 [11:45:22:155] < onnect[c0a8586cip:62801]: next timeout 1: 3000 ms
 [11:45:23:014] < pxEasyFit: ARP c0a8585bip -> c0a8586dip
 [11:45:23:014] < ipARP_REQUEST from c0a8585bip to c0a8586dip end-point c0a8586dip
 [11:45:25:147] < prvWinScaleFactor: uxRxWinSize 1 MSS 1460 Factor 0
 [11:45:25:163] < Connect[c0a8586cip:62801]: next timeout 2: 6000 ms
 [11:45:27:124] < FreeRTOS_FindEndPointOnNetMask[12]: No match for a0a0a01ip
 [11:45:31:153] < prvWinScaleFactor: uxRxWinSize 1 MSS 1460 Factor 0
 [11:45:31:153] < Connect[c0a8586cip:62801]: next timeout 3: 11000 ms

Where did you run this capture? Does the SYN reaches the server 192.168.88.108:62801? You can determine that by running at capture at the server.

can we see one of the SYN packets in detail? Could it be that the tcp and/or ip checksums are invalid (offloading issues) and therefore the packets are dropped by the peer?

Yes. The syn packet reaches 192.168.88.108:62801. An unstable connection is established after the device is rebooted. I capture packets using the router function, to which both the linux computer (192.168.88.116) and the device with freertos (192.168.88.109) and the destination device (192.168.88.108) are connected

Frame 41: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface \Device\NPF_{DF99D9F2-6A2B-491C-BBB3-7B35FE7DC4E5}, id 0
    Interface id: 0 (\Device\NPF_{DF99D9F2-6A2B-491C-BBB3-7B35FE7DC4E5})
        Interface name: \Device\NPF_{DF99D9F2-6A2B-491C-BBB3-7B35FE7DC4E5}
        Interface description: Ethernet
    Encapsulation type: Ethernet (1)
    Arrival Time: Aug 26, 2024 12:32:49.697283000  TZ 2 Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1724664769.697283000 seconds
    [Time delta from previous captured frame: 0.414988000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 5.285010000 seconds]
    Frame Number: 41
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp]
    [Coloring Rule Name: TCP SYN/FIN]
    [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb), Dst: c8:f0:9e:c3:b8:1f (c8:f0:9e:c3:b8:1f)
    Destination: c8:f0:9e:c3:b8:1f (c8:f0:9e:c3:b8:1f)
        Address: c8:f0:9e:c3:b8:1f (c8:f0:9e:c3:b8:1f)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb)
        Address: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.88.109, Dst: 192.168.88.108
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 52
    Identification: 0x001f (31)
    Flags: 0x0000
        0... .... .... .... = Reserved bit: Not set
        .0.. .... .... .... = Don't fragment: Not set
        ..0. .... .... .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (6)
    Header checksum: 0x087b [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.88.109
    Destination: 192.168.88.108
Transmission Control Protocol, Src Port: 22142, Dst Port: 62801, Seq: 0, Len: 0
    Source Port: 22142
    Destination Port: 62801
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)
    Sequence number (raw): 1916585591
    [Next sequence number: 1    (relative sequence number)]
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x002 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgment: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port 62801]
                [Connection establish request (SYN): server port 62801]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
        [TCP Flags: ยทยทยทยทยทยทยทยทยทยทSยท]
    Window size value: 1000
    [Calculated window size: 1000]
    Checksum: 0xb481 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
        TCP Option - Maximum segment size: 1460 bytes
            Kind: Maximum Segment Size (2)
            Length: 4
            MSS Value: 1460
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Window scale: 0 (multiply by 1)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 0
            [Multiplier: 1]
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - SACK permitted
            Kind: SACK Permitted (4)
            Length: 2
    [Timestamps]
        [Time since first frame in this TCP stream: 0.000000000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]

The sequence number looks fishy. If it is really 0, you may have a problem with your initialization of a rng. Could you please disable all packet interpretation in your capture utility and publish the raw packet as it is seen on the net?

at first I thought this was the problem (seq=0), but here is an example from Linux packages where the device has successfully connected. I see some extra feelds - TSval, WS and win parameter in freertos packets is 1000 but in linux win is 64240

well, if wireshark is configured to display the sequence numbers relative to the origin, you will see 0s in both cases even though it may be 0 in FreeRTOS and something valid in Linux. Do turn off all packet interpretation and LET US SEE the packet contents.

This is ok or you need some more info?

Frame 41: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface \Device\NPF_{DF99D9F2-6A2B-491C-BBB3-7B35FE7DC4E5}, id 0
Ethernet II, Src: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb), Dst: c8:f0:9e:c3:b8:1f (c8:f0:9e:c3:b8:1f)
    Destination: c8:f0:9e:c3:b8:1f (c8:f0:9e:c3:b8:1f)
        Address: c8:f0:9e:c3:b8:1f (c8:f0:9e:c3:b8:1f)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb)
        Address: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.88.109, Dst: 192.168.88.108
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 52
    Identification: 0x001f (31)
    Flags: 0x0000
        0... .... .... .... = Reserved bit: Not set
        .0.. .... .... .... = Don't fragment: Not set
        ..0. .... .... .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (6)
    Header checksum: 0x087b [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.88.109
    Destination: 192.168.88.108
Transmission Control Protocol, Src Port: 22142, Dst Port: 62801, Seq: 1916585591, Len: 0
    Source Port: 22142
    Destination Port: 62801
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1916585591
    [Next sequence number: 1916585592]
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x002 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgment: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port 62801]
                [Connection establish request (SYN): server port 62801]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
        [TCP Flags: ยทยทยทยทยทยทยทยทยทยทSยท]
    Window size value: 1000
    [Calculated window size: 1000]
    Checksum: 0xb481 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
        TCP Option - Maximum segment size: 1460 bytes
            Kind: Maximum Segment Size (2)
            Length: 4
            MSS Value: 1460
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Window scale: 0 (multiply by 1)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 0
            [Multiplier: 1]
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - SACK permitted
            Kind: SACK Permitted (4)
            Length: 2
    [Timestamps]
        [Time since first frame in this TCP stream: 0.000000000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]



looks ok so far, except that the nop tcp options look strange. Can you try to enable checksum verification in wireshark?

Also, double click on one of the SYN packets in wireshark and send us a screenshot of the graphical packet dump, even though it may be the same info as you already posted. My suspicion is that there is garbage data at the end of the packet which may make the checksums invalid, causing the receiver to drop the packet. Can you log network activity on the server (including dropped packets)?

Screenshot does not show all fields of packet. I attach in text format.

a small note from the freertos application, the connection to the mqtt server is successful.

 [16:37:36:761] < Prot Port IP-Remote       : Port  R/T Status       Alive  tmout Child
 [16:37:36:761] < TCP 35846 c0a8585bip                      : 1883 1/1 eESTABLISHED     470  20000
 [16:37:36:761] < TCP  4562 c0a8586cip                      :62801 0/0 eCONNECT_SYN    7617   1755
Frame 258439: 113 bytes on wire (904 bits), 113 bytes captured (904 bits) on interface \Device\NPF_{DF99D9F2-6A2B-491C-BBB3-7B35FE7DC4E5}, id 0
    Interface id: 0 (\Device\NPF_{DF99D9F2-6A2B-491C-BBB3-7B35FE7DC4E5})
        Interface name: \Device\NPF_{DF99D9F2-6A2B-491C-BBB3-7B35FE7DC4E5}
        Interface description: Ethernet
    Encapsulation type: Ethernet (1)
    Arrival Time: Aug 26, 2024 13:30:54.377340000 Russia TZ 2 Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1724668254.377340000 seconds
    [Time delta from previous captured frame: 0.015374000 seconds]
    [Time delta from previous displayed frame: 32.158701000 seconds]
    [Time since reference or first frame: 93.836457000 seconds]
    Frame Number: 258439
    Frame Length: 113 bytes (904 bits)
    Capture Length: 113 bytes (904 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:udp:tzsp:eth:ethertype:ip:tcp]
    [Coloring Rule Name: TCP SYN/FIN]
    [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Routerbo_d4:8f:8a (00:0c:42:d4:8f:8a), Dst: WestEnd_68:07:1b (00:e0:5b:68:07:1b)
    Destination: WestEnd_68:07:1b (00:e0:5b:68:07:1b)
        Address: WestEnd_68:07:1b (00:e0:5b:68:07:1b)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Routerbo_d4:8f:8a (00:0c:42:d4:8f:8a)
        Address: Routerbo_d4:8f:8a (00:0c:42:d4:8f:8a)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.88.188, Dst: 192.168.88.116
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 99
    Identification: 0x0000 (0)
    Flags: 0x4000, Don't fragment
        0... .... .... .... = Reserved bit: Not set
        .1.. .... .... .... = Don't fragment: Set
        ..0. .... .... .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: UDP (17)
    Header checksum: 0x0809 [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.88.188
    Destination: 192.168.88.116
User Datagram Protocol, Src Port: 41411, Dst Port: 37008
    Source Port: 41411
    Destination Port: 37008
    Length: 79
    Checksum: 0xf192 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 1]
    [Timestamps]
        [Time since first frame: 3488.370726000 seconds]
        [Time since previous frame: 0.015374000 seconds]
TZSP: Ethernet 
    Version: 1
    Type: Received packet (0)
    Encapsulation: Ethernet (1)
    End
        Option Tag: End (1)
Ethernet II, Src: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb), Dst: 6a:74:ec:12:d0:94 (6a:74:ec:12:d0:94)
    Destination: 6a:74:ec:12:d0:94 (6a:74:ec:12:d0:94)
        Address: 6a:74:ec:12:d0:94 (6a:74:ec:12:d0:94)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb)
        Address: 78:cd:55:42:1b:bb (78:cd:55:42:1b:bb)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.88.109, Dst: 192.168.88.91
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 52
    Identification: 0x0000 (0)
    Flags: 0x0000
        0... .... .... .... = Reserved bit: Not set
        .0.. .... .... .... = Don't fragment: Not set
        ..0. .... .... .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (6)
    Header checksum: 0x08ab [validation disabled]
    [Header checksum status: Unverified]
    Source: 192.168.88.109
    Destination: 192.168.88.91
Transmission Control Protocol, Src Port: 35846, Dst Port: 1883, Seq: 440715580, Len: 0
    Source Port: 35846
    Destination Port: 1883
    [Stream index: 924]
    [TCP Segment Len: 0]
    Sequence number: 440715580
    [Next sequence number: 440715581]
    Acknowledgment number: 0
    Acknowledgment number (raw): 0
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x002 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgment: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port 1883]
                [Connection establish request (SYN): server port 1883]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
        [TCP Flags: ยทยทยทยทยทยทยทยทยทยทSยท]
    Window size value: 1000
    [Calculated window size: 1000]
    Checksum: 0xc234 [correct]
    [Checksum Status: Good]
    [Calculated Checksum: 0xc234]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
        TCP Option - Maximum segment size: 1460 bytes
            Kind: Maximum Segment Size (2)
            Length: 4
            MSS Value: 1460
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Window scale: 0 (multiply by 1)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 0
            [Multiplier: 1]
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - SACK permitted
            Kind: SACK Permitted (4)
            Length: 2
    [Timestamps]
        [Time since first frame in this TCP stream: 0.000000000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]

wait a second. Your dump says protocol type is udp, but it decodes the packet as tcp? What is your code in freertos to create, bind and connect the socket?

Hmโ€ฆ

vtk_con_t vtk_con_open(const uint8_t address[4], uint16_t port, uint16_t tout)
{
  (void)tout;
  struct freertos_sockaddr server;
  vtk_con_t conn = VTK_CALLOC(sizeof(p_vtk_con_t), 1);

  conn->socket = FreeRTOS_socket(FREERTOS_AF_INET,FREERTOS_SOCK_STREAM,FREERTOS_IPPROTO_TCP);

  if (conn->socket == FREERTOS_INVALID_SOCKET)
  {
    VTK_FREE(conn);
    return NULL;
  }

  memset((char *) &server, 0, sizeof(server));

  server.sin_family = FREERTOS_AF_INET;
  uint32_t ip_addr;
  memcpy(&ip_addr, address, 4);
  server.sin_address.ulIP_IPv4= ip_addr;
  server.sin_port = port;
  uint8_t state;


  state = FreeRTOS_connect(conn->socket,&server,sizeof(server));
  if ( state  != 0) // connect(conn->socket, (struct sockaddr *)&server, sizeof(server))
  {
   FreeRTOS_closesocket(conn->socket);       
      VTK_FREE(conn);
    return NULL;
  }

  return conn;
}

if thatโ€™s what youโ€™re talking about, the router captures packets on the interface of my device (192.168.88.108) and sends them directly to wireshark via udp TZSP (TaZmen Sniffer Protocol) for online analysis

oh i see, there were two packets in the dump, sorry for that.

How about the source MAC address? Is it intentional that it is locally administrated?

Everything else looks ok.

Yes. I assign the mac address using 3 high bytes from vendors mac pool and 3 low bytes randomly

Looking at the above sequence, it seems that your FreeRTOS device sends another SYN (source port 42486) before the server is able to respond to the previous SYN (source port 46436). Can you try to slow down on the device? Are there any timeout that you are using to control how long to wait for a response?

This is not a prefix known in the IEEE OUI database. The locally administrated bit may confuse some component in the system. You may want to try some arbitrary prefix during development just to see if that is your problem.

we had a similar issue here: Connecting two zynqboards via ethernet (TCP+IP) - Kernel - FreeRTOS Community Forums