 | 1 | initial version |
Frame 6 contains a data segment, but also has the FIN flag set. When the FIN flag is set, it counts as if there was one byte of data (the phantom byte), which will trigger an ACK. The ACKing of both the data segment and the phantom byte of the FIN could have been done in one ACK, but apparently this TCP/IP stack ACKs the data part of the response separately from the phantom byte of the FIN flag. This results in one ACK for the data (ACK=248) and one ACK acking the phantom byte (ACK=249).
Which OSes are used for the client and the server?
