TCP – HTTP Closing Connection with One FIN Package

tcp

While on wireshark, I tried to connect to some site using http protocol. When I followed the TCP stream I saw that there was just one FIN package. How could this happen?

Edit:

The problem is I didn't save the capture and now each time I try to replicate it I obtain two handshakes I can tell http://elpais.com/ is the webpage I accessed.

I'm thinking about two possibilities:

1-I closed the capture before receiving all the packets.

2-I followed a special transition on the TCP transition diagram so that only one FIN was necessary to close the connection…(is that possible?)

Best Answer

Sounds like a half close

What are Half Closed Connections? Or: It's Not a Bug--it's a Feature!

Every TCP connection consists of two half-connection which are closed independently of each other. So if one end sends a FIN, then the other end is free to just ACK that FIN (instead of FIN+ACK-ing it), which signals the FIN-sending end that it still has data to send

https://superuser.com/questions/298919/what-is-tcp-half-open-connection-and-tcp-half-closed-connection