While on wireshark, I tried to connect to some site using http protocol. When I followed the TCP stream I saw that there was just one FIN package. How could this happen?
The problem is I didn't save the capture and now each time I try to replicate it I obtain two handshakes I can tell http://elpais.com/ is the webpage I accessed.
I'm thinking about two possibilities:
1-I closed the capture before receiving all the packets.
2-I followed a special transition on the TCP transition diagram so that only one FIN was necessary to close the connection...(is that possible?)