Ask Your Question
0

Closing connection with FIN, ACK

asked 2020-02-18 19:38:34 +0000

N3tw0rk_Sh4rk gravatar image

updated 2020-02-18 19:39:21 +0000

Looking to confirm which side of the wire is killing a connection between two servers. My suspicion is that 4.49.90.20 is closing down the connection with sending a FIN ACK. Does that look correct? See three attempts:

Attempt #1: https://imgur.com/a/zkVTuPZ Attempt #2: https://imgur.com/a/kcWAfbi Attempt #3: https://imgur.com/a/F3gLhXM

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-02-18 19:59:36 +0000

Chuckc gravatar image

updated 2020-02-18 19:59:57 +0000

Yes - that's correct.
It might be easier to look at if you apply a Conversation Filter->TCP to the SYN packet at the beginning of each example. There a mix of port numbers in the images from different connections.
Looks like from the packet timing that the capture was done on 10.220.100.103.
About 120-160 uSec after receiving the FIN, ACK from 4.49.90.20 it responds with a RST, ACK.

edit flag offensive delete link more

Comments

Thanks for confirming. Figured it was a 4.49 closing the connection because it was sent before the RST, ACK from 10.220

N3tw0rk_Sh4rk gravatar imageN3tw0rk_Sh4rk ( 2020-02-18 21:25:31 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-02-18 19:38:34 +0000

Seen: 6,342 times

Last updated: Feb 18 '20