4

As it's written on Wikipedia closing TCP connection should be using packets FIN->(FIN,ACK)->ACK. However when I use close() function to close socket I don't see FIN packet, there is instantly sent (FIN,ACK) packet from server to client, then client closes also connection by sending (FIN,ACK) and server responds with ACK packet. So where is the missing FIN packet (maybe it's merged to FIN,ACK)?

5
  • Are you sure, that the server didn't close the connection before? It looks like the server closes the connection
    – hek2mgl
    Jan 27, 2014 at 20:04
  • I don't see such a transition: blog.zhuzhaoyuan.com/wp-content/uploads/2009/03/tcp-states1.png create a minimal tcpdump example. Jan 27, 2014 at 20:07
  • I see that client sends FIN,ACK when I close socket with close() function then server responds with ACK
    – scdmb
    Jan 27, 2014 at 20:11
  • @scdmb Did you received only ACK from server or a FIN, ACK ?
    – hek2mgl
    Jan 27, 2014 at 21:02
  • It was FIN/ACK packet, looked more carefully
    – scdmb
    Jan 27, 2014 at 21:10

2 Answers 2

10

The closing sequence can also be different and don't need to have FIN+ACK inside the same packet:

  • ACK just acknowledges the receipt of data (e.g. received everything up to given sequence number)
  • packets will be re-send until one receives an ACK for them
  • FIN just says that the side sending the FIN will not send any more data. It gives no information if it will still receive data.
  • like every other packet FIN will be re-send until the receipt is acknowledged

Protocols like HTTP support a one-sided shutdown, e.g. the client sends the request data followed by a FIN to notify the server, that it will not send anymore data. But it will still receive the data send by the server. The server will acknowledge the FIN like it did with all the data before. Once the server is done it will send its own FIN which the client ACKs. In this case you have

1. client: FIN  (will not send more) 
2. server: ACK (received the FIN)
.. server: sends more data..., client ACKs these data 
3. server: FIN (will not send more)
4. client: ACK (received the FIN)

Note that the packet you see in step#1 might have an ACK inside too. But this ACK just acknowledges data send before by the server. If the server has no more data to send it might close the connection also. In this case steps 2+3 can be merged, e.g. the server sends a FIN+ACK, where the ACK acknowledges the FIN received by the client.

If one side sends its FIN the connection is called half-closed. It is fully closed once both sides send their FIN and received the ACK for the FIN, no matter if they do this in 3 or 4 packets.

2
  • +1 The key to understanding the ACK is that it applies to the specified acknowledgement number. FIN+ACK isn't special unless the acknowledgement number is lastdatabyte+1 (because FIN counts in sequence numbers, just like SYN does). Jan 27, 2014 at 23:02
  • Not really. This talks about optimizations like delayed ACK. The key is RFC793 (e.g. the RFC for TCP) section 3.5. But the RFC is not an easy read :) Jan 28, 2014 at 16:52
-2

You must have already received the FIN for you to be sending a FIN/ACK. Are you closing in response to reading EOS?

10
  • 1
    I thought this too, because it's in the docs. But you can try with telnet and wireshark. The client really sends FIN,ACK .. Then the server sends FIN,ACK and finally the client the ACK.. Observed on Linux 3.2
    – hek2mgl
    Jan 27, 2014 at 20:32
  • It seems like it is somewhat optional because the server only checks if FIN is set. However, I guess there is still a meaning :)
    – hek2mgl
    Jan 27, 2014 at 20:33
  • No, it isn't 'somewhat optional', it is required by RFC 793. Can you answer my question?
    – user207421
    Jan 27, 2014 at 20:39
  • I'm not the opener, unfortunately not. :)
    – hek2mgl
    Jan 27, 2014 at 20:40
  • That's not an answer to my question.
    – user207421
    Jan 27, 2014 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.