The behavior of faulty sessions from pcap is below: Client —> server [SYN] Server —> client [SYN, ACK] Client __> server [ACK] server —> client [ACK] Client ___> server [ACK] Server —> client [PSH, ACK] tcp segment of a reassembled PDU Client ___> server [ACK] Server —-> client [ACK] Client ___> server [FIN, ACK] Server —-> client [FIN, ACK]
Client initiated many flows but all are gone to FIN after getting push packet