SyntaxFix

[linux] What is the reason and how to avoid the [FIN, ACK] , [RST] and [RST, ACK]

What is the reason and how to avoid the [FIN, ACK], [RST] and [RST, ACK]?

Is it due to some mismatch between the TCP parameters of the SO´s? What does it mean when the server replies [FIN, ACK] in a TCP/IP connection?

10.118.113.237 is a Solaris box, while 10.118.110.63 is a Linux box.

No.     Time           Source                Destination           Protocol Length Info
  1 0.000000000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39679 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62389927 TSecr=355193509
  2 0.000015000    10.118.110.63         10.118.113.237        TCP      56     39679 > mmpft [RST] Seq=1 Win=0 Len=0
  4 0.119357000    10.118.110.63         10.118.113.237        TCP      68     39707 > mmpft [ACK] Seq=1 Ack=93 Win=54 Len=0 TSval=355208473 TSecr=62389939
  5 0.119475000    10.118.113.237        10.118.110.63         TCP      62     mmpft > 39707 [RST, ACK] Seq=93 Ack=1 Win=0 Len=0
  6 0.321336000    10.118.110.63         10.118.113.237        TCP      76     55603 > mmpft [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=355208524 TSecr=0 WS=128
  7 0.321835000    10.118.113.237        10.118.110.63         TCP      80     mmpft > 55603 [SYN, ACK] Seq=0 Ack=1 Win=49232 Len=0 TSval=62389959 TSecr=355208524 MSS=1460 WS=1 SACK_PERM=1
  8 0.321854000    10.118.110.63         10.118.113.237        TCP      68     55603 > mmpft [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSval=355208524 TSecr=62389959
  9 0.322552000    10.118.110.63         10.118.113.237        DIAMETER 276    cmd=Capabilities-ExchangeRequest(257) flags=R--- appl=Diameter Common Messages(0) h2h=3f3197c e2e=e9200846
 10 0.322891000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55603 [ACK] Seq=1 Ack=209 Win=49024 Len=0 TSval=62389959 TSecr=355208524
 11 0.342554000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39707 [FIN, ACK] Seq=93 Ack=1 Win=49232 Len=0 TSval=62389961 TSecr=355200968
 12 0.342567000    10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 13 0.346940000    10.118.113.237        10.118.110.63         DIAMETER 312    cmd=Capabilities-ExchangeAnswer(257) flags=---- appl=Diameter Common Messages(0) h2h=3f3197c e2e=e9200846
 14 0.347021000    10.118.110.63         10.118.113.237        TCP      68     55603 > mmpft [ACK] Seq=209 Ack=245 Win=6912 Len=0 TSval=355208530 TSecr=62389961
 15 4.288733000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39652 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390356 TSecr=355186382
 16 4.288757000    10.118.110.63         10.118.113.237        TCP      56     39652 > mmpft [RST] Seq=1 Win=0 Len=0
 17 4.398722000    10.118.113.237        10.118.110.63         DIAMETER 160    [TCP Retransmission] cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad2 e2e=5f8035e4
 18 4.398734000    10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 19 4.938748000    10.118.113.237        10.118.110.63         DIAMETER 160    cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad0 e2e=5f8035df
 20 4.938770000    10.118.110.63         10.118.113.237        TCP      56     39598 > mmpft [RST] Seq=1 Win=0 Len=0
 21 5.498759000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 39544 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390477 TSecr=355156526
 22 5.498783000    10.118.110.63         10.118.113.237        TCP      56     39544 > mmpft [RST] Seq=1 Win=0 Len=0
 23 5.648780000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55774 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390492 TSecr=355111580
 24 5.648804000    10.118.110.63         10.118.113.237        TCP      56     55774 > mmpft [RST] Seq=1 Win=0 Len=0
 25 5.942885000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55828 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390521 TSecr=355126129
 26 5.942901000    10.118.110.63         10.118.113.237        TCP      56     55828 > mmpft [RST] Seq=1 Win=0 Len=0
 27 6.668742000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55666 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390594 TSecr=355081310
 28 6.668760000    10.118.110.63         10.118.113.237        TCP      56     55666 > mmpft [RST] Seq=1 Win=0 Len=0
 29 7.258815000    10.118.113.237        10.118.110.63         TCP      68     mmpft > 55720 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62390653 TSecr=355096418
 31 7.418827000    10.118.113.237        10.118.110.63         DIAMETER 160    cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889acd e2e=5f8035d9
 32 7.418835000    10.118.110.63         10.118.113.237        TCP      56     39490 > mmpft [RST] Seq=1 Win=0 Len=0
 33 12.948752000   10.118.113.237        10.118.110.63         DIAMETER 160    [TCP Retransmission] cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad2 e2e=5f8035e4
 34 12.948776000   10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 35 30.030087000   10.118.113.237        10.118.110.63         DIAMETER 160    [TCP Retransmission] cmd=Device-WatchdogRequest(280) flags=R--- appl=Diameter Common Messages(0) h2h=f889ad2 e2e=5f8035e4
 36 30.030113000   10.118.110.63         10.118.113.237        TCP      56     39707 > mmpft [RST] Seq=1 Win=0 Len=0
 38 30.369302000   10.118.110.63         10.118.113.237        TCP      68     55603 > mmpft [ACK] Seq=209 Ack=337 Win=6912 Len=0 TSval=355216035 TSecr=62392964
 39 30.369413000   10.118.113.237        10.118.110.63         TCP      62     mmpft > 55603 [RST, ACK] Seq=337 Ack=209 Win=0 Len=0
 40 30.571231000   10.118.110.63         10.118.113.237        TCP      76     55630 > mmpft [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=355216086 TSecr=0 WS=128
 41 30.571603000   10.118.113.237        10.118.110.63         TCP      80     mmpft > 55630 [SYN, ACK] Seq=0 Ack=1 Win=49232 Len=0 TSval=62392984 TSecr=355216086 MSS=1460 WS=1 SACK_PERM=1
 42 30.571620000   10.118.110.63         10.118.113.237        TCP      68     55630 > mmpft [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSval=355216086 TSecr=62392984
 43 30.572253000   10.118.110.63         10.118.113.237        DIAMETER 276    cmd=Capabilities-ExchangeRequest(257) flags=R--- appl=Diameter Common Messages(0) h2h=3f3197d e2e=e9200847
 44 30.572638000   10.118.113.237        10.118.110.63         TCP      68     mmpft > 55630 [ACK] Seq=1 Ack=209 Win=49232 Len=0 TSval=62392984 TSecr=355216086
 45 30.579815000   10.118.113.237        10.118.110.63         TCP      68     mmpft > 55603 [FIN, ACK] Seq=337 Ack=209 Win=49232 Len=0 TSval=62392985 TSecr=355208530
 46 30.579826000   10.118.110.63         10.118.113.237        TCP      56     55603 > mmpft [RST] Seq=209 Win=0 Len=0
 47 30.581517000   10.118.113.237        10.118.110.63         DIAMETER 312    cmd=Capabilities-ExchangeAnswer(257) flags=---- appl=Diameter Common Messages(0) h2h=3f3197d e2e=e9200847
 48 30.581553000   10.118.110.63         10.118.113.237        TCP      68     55630 > mmpft [ACK] Seq=209 Ack=245 Win=6912 Len=0 TSval=355216088 TSecr=62392985
 49 34.138766000   10.118.113.237        10.118.110.63         TCP      68     mmpft > 39679 [FIN, ACK] Seq=1 Ack=1 Win=49232 Len=0 TSval=62393341 TSecr=355193509
 50 34.138790000   10.118.110.63         10.118.113.237        TCP      56     39679 > mmpft [RST] Seq=1 Win=0 Len=0

This question is related to linux sockets tcp solaris wireshark

The answer is

Here is a rough explanation of the concepts.

[ACK] is the acknowledgement that the previously sent data packet was received.

[FIN] is sent by a host when it wants to terminate the connection; the TCP protocol requires both endpoints to send the termination request (i.e. FIN).

So, suppose

  • host A sends a data packet to host B
  • and then host B wants to close the connection.
  • Host B (depending on timing) can respond with [FIN,ACK] indicating that it received the sent packet and wants to close the session.
  • Host A should then respond with a [FIN,ACK] indicating that it received the termination request (the ACK part) and that it too will close the connection (the FIN part).

However, if host A wants to close the session after sending the packet, it would only send a [FIN] packet (nothing to acknowledge) but host B would respond with [FIN,ACK] (acknowledges the request and responds with FIN).

Finally, some TCP stacks perform half-duplex termination, meaning that they can send [RST] instead of the usual [FIN,ACK]. This happens when the host actively closes the session without processing all the data that was sent to it. Linux is one operating system which does just this.

You can find a more detailed and comprehensive explanation here.

Source: Stackoverflow.com

Examples related to linux

• grep's at sign caught as whitespace • How to prevent Google Colab from disconnecting? • "E: Unable to locate package python-pip" on Ubuntu 18.04 • How to upgrade Python version to 3.7? • Install Qt on Ubuntu • Get first line of a shell command's output • Cannot connect to the Docker daemon at unix:/var/run/docker.sock. Is the docker daemon running? • Run bash command on jenkins pipeline • How to uninstall an older PHP version from centOS7 • How to update-alternatives to Python 3 without breaking apt?

Examples related to sockets

• JS file gets a net::ERR_ABORTED 404 (Not Found) • mysqld_safe Directory '/var/run/mysqld' for UNIX socket file don't exists • WebSocket connection failed: Error during WebSocket handshake: Unexpected response code: 400 • TypeError: a bytes-like object is required, not 'str' • Failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED • No connection could be made because the target machine actively refused it 127.0.0.1 • Sending a file over TCP sockets in Python • socket connect() vs bind() • java.net.SocketException: Connection reset by peer: socket write error When serving a file • How do I use setsockopt(SO_REUSEADDR)?

Examples related to tcp

• What does "app.run(host='0.0.0.0') " mean in Flask • What is the difference between HTTP 1.1 and HTTP 2.0? • Sending a file over TCP sockets in Python • Telnet is not recognized as internal or external command • How to open port in Linux • adb connection over tcp not working now • Understanding [TCP ACKed unseen segment] [TCP Previous segment not captured] • How do I debug error ECONNRESET in Node.js? • Differences between TCP sockets and web sockets, one more time • Is SMTP based on TCP or UDP?

Examples related to solaris

• How to get rid of the "No bootable medium found!" error in Virtual Box? • What is the reason and how to avoid the [FIN, ACK] , [RST] and [RST, ACK] • sed edit file in place • Windows equivalent of linux cksum command • How to use S_ISREG() and S_ISDIR() POSIX Macros? • Test if remote TCP port is open from a shell script • Portable way to get file size (in bytes) in shell? • Get the date (a day before current time) in Bash • How to set the From email address for mailx command? • How to determine the IP address of a Solaris system

Examples related to wireshark

• How to filter wireshark to see only dns queries that are sent/received from/by my computer? • Understanding [TCP ACKed unseen segment] [TCP Previous segment not captured] • What is the reason and how to avoid the [FIN, ACK] , [RST] and [RST, ACK] • Capturing mobile phone traffic on Wireshark • Why doesn't wireshark detect my interface? • Wireshark localhost traffic capture • Monitor network activity in Android Phones • How do I monitor all incoming http requests? • Wireshark vs Firebug vs Fiddler - pros and cons? • How to filter by IP address in Wireshark?

Tags

Hsv Actionmethod Android-animation Symbol-tables Focus-stealing Vala Sicp Qlocalsocket Nssavepanel Subsonic2.0 Authorizationmanager Design-guidelines Http-chunked Ode Fastercsv Multiprocessing Integral Chdir Orchestration Quicksort Ogg Numa Msxml6 Timetable Mouseleftbuttonup Copy-item Mod-ssl Lookaround Suexec Zest Hydra Facets Alternate-data-stream Subst For-loop Memory-table Aggregation String-utils Dataflex Side-by-side Source-server Table-driven Selenium-grid Instrumentation Fdb Django-pagination Escalation Grep Event-based-programming Datagridtemplatecolumn Process-monitoring Ii6 Iphone-video Oracleexception Blogengine.net Facebook-chat Renaming Appendto Pixel-shading Tigase Digital-signature Feature-driven Xmlrpcclient Html5-animation Minitest Pythagorean Gen-server Weborb Adobe-flash-cs3 Create-function Arrows Csvde Htmlunit Jsyntaxpane System-font Truss Umdh Equivalence-classes Automerge Pg-dump Userland Nsnumber Paypal-ipn Shiva3d Commandlink Treelist Resourcedictionary Datadirectory File.readalllines Subforms Beautifulsoup Pow Eval Virtual-machine Layout-manager Pdf-conversion Pynotify Pony Genuinechannels Code-injection