From: Johnny Billquist <bqt at softjar.se> But is there any sane reason why Linux would SYN-ACK twice, and the second one more than a second after the first. Completely stupid theory: last time I did any testing with Linux, it seemed that it would *always* lose the very first packet sent to a given local IP address, because it would send an ARP request instead and then forget why it asked (i.e. drop the outgoing frame since it depended, IMHO wrongly, on the higher-level protocol to time out and resend). Maybe they fixed that bug twice? I.e. did a workaround to send the SYN+ACK twice, and then later did the *real* bug fix to maintain a queue of packets waiting for an ARP reply, so now you get two? Seems silly but this would be the result. John Wilson D Bit