0

I use the WireShark captured the TCP connect.

you see the three-way handshake(1-3) and the four-way handshake(5-8):

enter image description here

But, from the frame list, I have a question about TCP.

You know the TCP should use ACK sign to get the response, no matter the ack for syn, or ack for data send.

you see the 4rd frame, the 192.168.187.1 send the message to 192.168.187.129 [PSH, ACK].

  1. but the 192.168.187.1 haven't get a ACK, it send the FIN package to 192.168.187.129, why?

  2. in the 5rd package, can it send the [FIN] package directly? why there need the [FIN, ACK]? why can not send the [FIN]?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 18:50
3
  1. RFC 793 indicates that:

FIN

A control bit (finis) occupying one sequence number, which indicates that the sender will send no more data or control occupying sequence space.

If the sender has no more data to send, it sends a packet which its FIN flag is set. If the receiver doesn't receive data, it will send a duplicate ACK to the sender.

So the sender waits for a time and if it doesn't receive acknowledgment of the FIN or data within this time, or if it receives a duplicate ACK, it will retransmit the packets.

  1. ACK control flag is always sent once a connection is established; As RFC 793 says:

Acknowledgment Number: 32 bits

If the ACK control bit is set this field contains the value of the next sequence number the sender of the segment is expecting to receive. Once a connection is established this is always sent.

Edit: So until the connection is not established, packets can be sent without ACK.

For example, when one side of the connection sends SYN packet and doesn't receive any acknowledgment; in this case, it can send a FIN packet without ACK, since there is nothing to acknowledge it.

RCF793:3.5. Closing a Connection also indicates that:

The user who CLOSEs may continue to RECEIVE until he is told that the other side has CLOSED also.

Sending ACK will tell to the sender that which sequence number is expected to receive and it prevents extra retransmissions that occur because of ACK lost.


Edited based on @ron-maupin 's comment.

| improve this answer | |
  • 1
    "ACK control flag is always set to 1 once a connection is established;" You misinterpreted the quote. The acknowledgement number is always sent one a connection is established, but the ACK flag is only sent when there is actually something to acknowledge. In most cases, the ACK flag is always sent because each side needs to acknowledge something from the other, but there are cases where one side is only acknowledging what the other side is sending, and the sending side has nothing to acknowledge from the other side. The acknowledgement number tells the other side what is expected. – Ron Maupin Sep 3 '19 at 15:42
1

but the 192.168.187.1 haven't get a ACK, it send the FIN package to 192.168.187.129, why?

Apparently, 192.168.187.1 has finished sending and is closing the socket. That is entirely normal.

in the 5rd package, can it send the [FIN] package directly? why there need the [FIN, ACK]? why can not send the [FIN]?

FIN and ACK are combined in a single segment, this is completely normal as well. The flags are sent in a bit field, so they can be combined to avoid sending extra segments for each status change.

| improve this answer | |
  • Can it only send the [FIN] not [FIN, ACK]? – 244boy Sep 3 '19 at 13:34
  • It's possible, but it's customary to use any opportunity to ACK the received data, even if it's redundant. – Zac67 Sep 3 '19 at 16:34
  • @244boy, the side sending the FIN is also acknowledging what was sent to it. In theory, if there was nothing to acknowledge, then a FIN could be sent alone. There is a chart on page 23 of RFC 793 that explains the flow. Also, Section 3.5. Closing a Connection clearly explains how connections are closed using FIN.. – Ron Maupin Sep 3 '19 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.