1

Well, I got a pcap package that uses the tcpdump command. In this pcap, the TCP closes in 2-way handshake!

Questions:

  1. In this picture, can anyone determine who initiated the signal to close the connection?
  2. Why does TCP close in a 2-way handshake? It does not seem to make common sense!
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 19 '20 at 22:34
2

The 172.16.10.252 host sent the FIN to initiate the close. That host is required to keep receiving and processing data segments from the other host until the other host ACKs the FIN.

When a host sends a FIN, that means it will be sending no more data segments, but it will continue to receive data segments from the other host. A host can immediately terminate a connection with a RST.

It's all explained in RFC 793, Transmission Control Protocol:

                              +---------+ ---------\      active OPEN
                              |  CLOSED |            \    -----------
                              +---------+<---------\   \   create TCB
                                |     ^              \   \  snd SYN
                   passive OPEN |     |   CLOSE        \   \
                   ------------ |     | ----------       \   \
                    create TCB  |     | delete TCB         \   \
                                V     |                      \   \
                              +---------+            CLOSE    |    \
                              |  LISTEN |          ---------- |     |
                              +---------+          delete TCB |     |
                   rcv SYN      |     |     SEND              |     |
                  -----------   |     |    -------            |     V
 +---------+      snd SYN,ACK  /       \   snd SYN          +---------+
 |         |<-----------------           ------------------>|         |
 |   SYN   |                    rcv SYN                     |   SYN   |
 |   RCVD  |<-----------------------------------------------|   SENT  |
 |         |                    snd ACK                     |         |
 |         |------------------           -------------------|         |
 +---------+   rcv ACK of SYN  \       /  rcv SYN,ACK       +---------+
   |           --------------   |     |   -----------
   |                  x         |     |     snd ACK
   |                            V     V
   |  CLOSE                   +---------+
   | -------                  |  ESTAB  |
   | snd FIN                  +---------+
   |                   CLOSE    |     |    rcv FIN
   V                  -------   |     |    -------
 +---------+          snd FIN  /       \   snd ACK          +---------+
 |  FIN    |<-----------------           ------------------>|  CLOSE  |
 | WAIT-1  |------------------                              |   WAIT  |
 +---------+          rcv FIN  \                            +---------+
   | rcv ACK of FIN   -------   |                            CLOSE  |
   | --------------   snd ACK   |                           ------- |
   V        x                   V                           snd FIN V
 +---------+                  +---------+                   +---------+
 |FINWAIT-2|                  | CLOSING |                   | LAST-ACK|
 +---------+                  +---------+                   +---------+
   |                rcv ACK of FIN |                 rcv ACK of FIN |
   |  rcv FIN       -------------- |    Timeout=2MSL -------------- |
   |  -------              x       V    ------------        x       V
    \ snd ACK                 +---------+delete TCB         +---------+
     ------------------------>|TIME WAIT|------------------>| CLOSED  |
                              +---------+                   +---------+

                      TCP Connection State Diagram
                               Figure 6.
2
  • processing data segments from the other host until the other host ACKs the FIN. After it has received the ACK for its FIN, it's in state FINWAIT-2 and should still accept data segments from the other host. I think that's what you actually say in the second paragraph. Alternatively, it could receive a FIN before the ACK of its own FIN and move in state CLOSING.
    – JeanPierre
    May 15 '18 at 19:20
  • Basically, the reason for the two-way handshake on the close (the question) is that one side says, "I'm done, let me know when you are done." If it is done and has no interest in continuing with anything, it can send a RST.
    – Ron Maupin
    May 15 '18 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.