Ask Your Question

Closing connection with FIN, ACK

asked 2020-02-18 19:38:34 +0000

N3tw0rk_Sh4rk gravatar image

updated 2020-02-18 19:39:21 +0000

Looking to confirm which side of the wire is killing a connection between two servers. My suspicion is that is closing down the connection with sending a FIN ACK. Does that look correct? See three attempts:

Attempt #1: Attempt #2: Attempt #3:

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-02-18 19:59:36 +0000

Chuckc gravatar image

updated 2020-02-18 19:59:57 +0000

Yes - that's correct.
It might be easier to look at if you apply a Conversation Filter->TCP to the SYN packet at the beginning of each example. There a mix of port numbers in the images from different connections.
Looks like from the packet timing that the capture was done on
About 120-160 uSec after receiving the FIN, ACK from it responds with a RST, ACK.

edit flag offensive delete link more


Thanks for confirming. Figured it was a 4.49 closing the connection because it was sent before the RST, ACK from 10.220

N3tw0rk_Sh4rk gravatar imageN3tw0rk_Sh4rk ( 2020-02-18 21:25:31 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-02-18 19:38:34 +0000

Seen: 5,895 times

Last updated: Feb 18 '20