CODEWITHSUNDEEP
socketstcp
Andrew Spott
Andrew Spott

Reputation: 3627

Parsing the end of a tcp connection

There are a number of ways that a TCP connection can end. This is my understanding:

rst: is immediate. The connection is done, and immediately closes. All further communication is a "new" connection.

fin: is a nice request from one side. It must be acknowledged, and the other side then sends a fin to say they are done talking. This too must be acknowledged. These stages CAN happen simultaneously, but a fin and the ack that accompanies it must be passed.

Are there any others? I'm looking at a tcp stream in Wireshark that just has a fin, psh, and ack bit sent. This is acknowledged and the connection is over. What other ways of closing a TCP connection are there?

If a fin is acked, can more data be sent? If it is, does the original fin need to be resent (does the state of the side that sent the fin reset at some point)?

Upvotes: 2

Views: 139

Answers (2)

Philip Stuyck
Philip Stuyck

Reputation: 7447

There is indeed only 2 ways to close a TCP connection.

  • The FIN 4 way handshake
  • The RST

The FIN mechanism is the normal way of closing a TCP connection. You must understand that a TCP socket has a state machine underneeth. This statemachine is checked for each operation on the socket that happens. A close on a socket is called a halfclose. If you do this, it is like telling I have nothing more to send anymore. The state machine underneeth the socket is really going to check this, if you still were to try to send you will get error return codes. The statemachine i am talking about is very well described over here with drawings ;-) http://www.tcpipguide.com/free/t_TCPOperationalOverviewandtheTCPFiniteStateMachineF-2.htm

The TCP/IP guide is an online book, also the RST scenario's that can happen are described in that book, as is the sliding window mechanism, byte acking, nagle and many other things. And not just for TCP, other protocols as well.

Upvotes: 1

user207421
user207421

Reputation: 310860

Are there any others?

No.

I'm looking at a tcp stream in Wireshark that just has a fin, psh, and ack bit sent. This is acknowledged and the connection is over.

No. It is shut down in one direction only. It isn't over until both peers have sent a FIN.

What other ways of closing a TCP connection are there?

None.

If a fin is acked, can more data be sent?

It can't be sent even if the FIN wasn't ACKed, in the direction that the FIN was sent. It can be sent in the other direction.

If it is, does the original fin need to be resent (does the state of the side that sent the fin reset at some point)?

Can't happen.

Upvotes: 2

Related Questions