2

While on wireshark, I tried to connect to some site using http protocol. When I followed the TCP stream I saw that there was just one FIN package. How could this happen?

Edit:

The problem is I didn't save the capture and now each time I try to replicate it I obtain two handshakes I can tell http://elpais.com/ is the webpage I accessed.

I'm thinking about two possibilities:

1-I closed the capture before receiving all the packets.

2-I followed a special transition on the TCP transition diagram so that only one FIN was necessary to close the connection...(is that possible?)

Improve this question
3
  • Can you please provide more information? If possible a copy of the packet capture would be great. If not a screenshot would do.
    – OzNetNerd
    Nov 19, 2015 at 10:31
  • If I'm understanding you correctly, it sounds like you had a multiple threads for one website. This would explain why you saw two handshakes and why you were expecting to see two FINs. The most likely answer is that, as you mentioned, you stopped the capture before the second FIN was sent. Or perhaps a RESET was used to terminate the second connection instead. In regards to your question, no, it's not possible to bring down two separate TCP connections with a single FIN packet.
    – OzNetNerd
    Nov 20, 2015 at 11:47
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 12, 2017 at 21:49

1 Answer 1

Reset to default
4

Sounds like a half close

What are Half Closed Connections? Or: It's Not a Bug--it's a Feature!

Every TCP connection consists of two half-connection which are closed independently of each other. So if one end sends a FIN, then the other end is free to just ACK that FIN (instead of FIN+ACK-ing it), which signals the FIN-sending end that it still has data to send

https://superuser.com/questions/298919/what-is-tcp-half-open-connection-and-tcp-half-closed-connection

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.