As it's written on Wikipedia closing TCP connection should be using packets FIN->(FIN,ACK)->ACK. However when I use close() function to close socket I don't see FIN packet, there is instantly sent (FIN,ACK) packet from server to client, then client closes also connection by sending (FIN,ACK) and server responds with ACK packet. So where is the missing FIN packet (maybe it's merged to FIN,ACK)?
Linux – FIN omitted, FIN-ACK sent
linuxnetworkingsocketstcp
Best Answer
The closing sequence can also be different and don't need to have FIN+ACK inside the same packet:
Protocols like HTTP support a one-sided shutdown, e.g. the client sends the request data followed by a FIN to notify the server, that it will not send anymore data. But it will still receive the data send by the server. The server will acknowledge the FIN like it did with all the data before. Once the server is done it will send its own FIN which the client ACKs. In this case you have
Note that the packet you see in step#1 might have an ACK inside too. But this ACK just acknowledges data send before by the server. If the server has no more data to send it might close the connection also. In this case steps 2+3 can be merged, e.g. the server sends a FIN+ACK, where the ACK acknowledges the FIN received by the client.
If one side sends its FIN the connection is called half-closed. It is fully closed once both sides send their FIN and received the ACK for the FIN, no matter if they do this in 3 or 4 packets.