What is the reason and how to avoid the [FIN, ACK] , [RST] and [RST, ACK]

linux sockets tcp solaris wireshark
Sergio Pettena picture Sergio Pettena · Mar 3, 2013 · Viewed 128.1k times · Source

What is the reason and how to avoid the [FIN, ACK], [RST] and [RST, ACK]?

Is it due to some mismatch between the TCP parameters of the SO´s? What does it mean when the server replies [FIN, ACK] in a TCP/IP connection?

10.118.113.237 is a Solaris box, while 10.118.110.63 is a Linux box.

No.     Time           Source                Destination           Protocol Length Info
  1 0.000000000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39679 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62389927 TSecr=355193509
  2 0.000015000    10.118.110.63         10.118.113.237        TCP      56     39679 > mmpft [RST] Seq=1 Win=0 Len=0
  4 0.119357000    10.118.110.63         10.118.113.237        TCP      68     39707 > mmpft [ACK] Seq=1 Ack=93 Win=54 Len=0 TSval=355208473 TSecr=62389939
  5 0.119475000    10.118.113.237        10.118.110.63         TCP      62     mmpft > 39707 [RST, ACK] Seq=93 Ack=1 Win=0 Len=0
  6 0.321336000    10.118.110.63         10.118.113.237        TCP      76     55603 > mmpft [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=355208524 TSecr=0 WS=128
  7 0.321835000    10.118.113.237        10.118.110.63         TCP      80     mmpft > 55603 [SYN, ACK] Seq=0 Ack=1 Win=49232 Len=0 TSval=62389959 TSecr=355208524 MSS=1460 WS=1 SACK_PERM=1
  8 0.321854000    10.118.110.63         10.118.113.237        TCP      68     55603 > mmpft [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSval=355208524 TSecr=62389959
  9 0.322552000    10.118.110.63         10.118.113.237        DIAMETER 276    cmd=Capabilities-ExchangeRequest(257) flags=R--- appl=Diameter Common Messages(0) h2h=3f3197c e2e=e9200846
 10 0.322891000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55603 [ACK] Seq=1 Ack=209 Win=49024 Len=0 TSval=62389959 TSecr=355208524
 11 0.342554000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39707 [FIN, ACK] Seq=93 Ack=1 Win=49232 Len=0 TSval=62389961 TSecr=355200968
 12 0.342567000    10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 13 0.346940000    10.118.113.237        10.118.110.63         DIAMETER 312    cmd=Capabilities-ExchangeAnswer(257) flags=---- appl=Diameter Common Messages(0) h2h=3f3197c e2e=e9200846
 14 0.347021000    10.118.110.63         10.118.113.237        TCP      68     55603 > mmpft [ACK] Seq=209 Ack=245 Win=6912 Len=0 TSval=355208530 TSecr=62389961
 15 4.288733000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39652 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390356 TSecr=355186382
 16 4.288757000    10.118.110.63         10.118.113.237        TCP      56     39652 > mmpft [RST] Seq=1 Win=0 Len=0
 17 4.398722000    10.118.113.237        10.118.110.63         DIAMETER 160    [TCP Retransmission] cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad2 e2e=5f8035e4
 18 4.398734000    10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 19 4.938748000    10.118.113.237        10.118.110.63         DIAMETER 160    cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad0 e2e=5f8035df
 20 4.938770000    10.118.110.63         10.118.113.237        TCP      56     39598 > mmpft [RST] Seq=1 Win=0 Len=0
 21 5.498759000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39544 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390477 TSecr=355156526
 22 5.498783000    10.118.110.63         10.118.113.237        TCP      56     39544 > mmpft [RST] Seq=1 Win=0 Len=0
 23 5.648780000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55774 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390492 TSecr=355111580
 24 5.648804000    10.118.110.63         10.118.113.237        TCP      56     55774 > mmpft [RST] Seq=1 Win=0 Len=0
 25 5.942885000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55828 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390521 TSecr=355126129
 26 5.942901000    10.118.110.63         10.118.113.237        TCP      56     55828 > mmpft [RST] Seq=1 Win=0 Len=0
 27 6.668742000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55666 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390594 TSecr=355081310
 28 6.668760000    10.118.110.63         10.118.113.237        TCP      56     55666 > mmpft [RST] Seq=1 Win=0 Len=0
 29 7.258815000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55720 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390653 TSecr=355096418
 31 7.418827000    10.118.113.237        10.118.110.63         DIAMETER 160    cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889acd e2e=5f8035d9
 32 7.418835000    10.118.110.63         10.118.113.237        TCP      56     39490 > mmpft [RST] Seq=1 Win=0 Len=0
 33 12.948752000   10.118.113.237        10.118.110.63         DIAMETER 160    [TCP Retransmission] cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad2 e2e=5f8035e4
 34 12.948776000   10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 35 30.030087000   10.118.113.237        10.118.110.63         DIAMETER 160    [TCP Retransmission] cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad2 e2e=5f8035e4
 36 30.030113000   10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 38 30.369302000   10.118.110.63         10.118.113.237        TCP      68     55603 > mmpft [ACK] Seq=209 Ack=337 Win=6912 Len=0 TSval=355216035 TSecr=62392964
 39 30.369413000   10.118.113.237        10.118.110.63         TCP      62     mmpft > 55603 [RST, ACK] Seq=337 Ack=209 Win=0 Len=0
 40 30.571231000   10.118.110.63         10.118.113.237        TCP      76     55630 > mmpft [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=355216086 TSecr=0 WS=128
 41 30.571603000   10.118.113.237        10.118.110.63         TCP      80     mmpft > 55630 [SYN, ACK] Seq=0 Ack=1 Win=49232 Len=0 TSval=62392984 TSecr=355216086 MSS=1460 WS=1 SACK_PERM=1
 42 30.571620000   10.118.110.63         10.118.113.237        TCP      68     55630 > mmpft [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSval=355216086 TSecr=62392984
 43 30.572253000   10.118.110.63         10.118.113.237        DIAMETER 276    cmd=Capabilities-ExchangeRequest(257) flags=R--- appl=Diameter Common Messages(0) h2h=3f3197d e2e=e9200847
 44 30.572638000   10.118.113.237        10.118.110.63         TCP      68     mmpft > 55630 [ACK] Seq=1 Ack=209 Win=49232 Len=0 TSval=62392984 TSecr=355216086
 45 30.579815000   10.118.113.237        10.118.110.63         TCP      68     mmpft > 55603 [FIN, ACK] Seq=337 Ack=209 Win=49232 Len=0 TSval=62392985 TSecr=355208530
 46 30.579826000   10.118.110.63         10.118.113.237        TCP      56     55603 > mmpft [RST] Seq=209 Win=0 Len=0
 47 30.581517000   10.118.113.237        10.118.110.63         DIAMETER 312    cmd=Capabilities-ExchangeAnswer(257) flags=---- appl=Diameter Common Messages(0) h2h=3f3197d e2e=e9200847
 48 30.581553000   10.118.110.63         10.118.113.237        TCP      68     55630 > mmpft [ACK] Seq=209 Ack=245 Win=6912 Len=0 TSval=355216088 TSecr=62392985
 49 34.138766000   10.118.113.237        10.118.110.63         TCP      68     mmpft > 39679 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62393341 TSecr=355193509
 50 34.138790000   10.118.110.63         10.118.113.237        TCP      56     39679 > mmpft [RST] Seq=1 Win=0 Len=0

Answer

isedev picture isedev · Mar 3, 2013

Here is a rough explanation of the concepts.

[ACK] is the acknowledgement that the previously sent data packet was received.

[FIN] is sent by a host when it wants to terminate the connection; the TCP protocol requires both endpoints to send the termination request (i.e. FIN).

So, suppose

  • host A sends a data packet to host B
  • and then host B wants to close the connection.
  • Host B (depending on timing) can respond with [FIN,ACK] indicating that it received the sent packet and wants to close the session.
  • Host A should then respond with a [FIN,ACK] indicating that it received the termination request (the ACK part) and that it too will close the connection (the FIN part).

However, if host A wants to close the session after sending the packet, it would only send a [FIN] packet (nothing to acknowledge) but host B would respond with [FIN,ACK] (acknowledges the request and responds with FIN).

Finally, some TCP stacks perform half-duplex termination, meaning that they can send [RST] instead of the usual [FIN,ACK]. This happens when the host actively closes the session without processing all the data that was sent to it. Linux is one operating system which does just this.

You can find a more detailed and comprehensive explanation here.

Related questions

How many socket connections possible?

Has anyone an idea how many tcp-socket connections are possible on a modern standard root server? (There is in general less traffic on each connection, but all the connections have to be up all the time.) EDIT: We will use …

Read More
Linux: is there a read or recv from socket with timeout?

How can I try to read data from socket with timeout? I know, select, pselect, poll, has a timeout field, but using of them disables "tcp fast-path" in tcp reno stack. The only idea I have is to use recv(…

Read More
Simple Socket Server in Bash?

Is there a way to quickly bind to a TCP port/ip address and simply print out all information to STDOUT? I have a simple debugging solution which writes things to 127.0.0.1:4444 and I'd like to be able to simply bind …

Read More