 the sender is finished sending data
The data portion of the segment is optional. On connection and termination segments are exchanged without data.
Chapter 18: TCP Connection Establishment and Termination
TCP is a connection-oriented protocol. Before either end can send data to the other, a connection must be established between them.
tcpdump abbreviates the flags S (SYN), F (FIN), R (RST), P (PSH) and . (no flags).
1415531521:1415531521 (0) means the sequence number of the packet was 1415531521 and the number of data bytes in the segment was 0.
win shows the window size.
<mss 1024> shows the maximum segment size (MSS) option specified by the sender. The sender does not want to receive TCP segments larger than this value.
To establish a TCP connection:
- The requesting end (normally called the client) sends a SYN segment specifying the port number of the server that the client wants to connect to, and the client's initial sequence number (ISN, 1415531521 in this example). This is segment 1.
- The server responds with its own SYN segment containing the server's initial sequence number (segment 2). The server also acknowledges the client's SYN by ACKing the client's ISN plus one. A SYN consumes one sequence number.
- The client must acknowledge this SYN from the server by ACKing the server's ISN plus one (segment 3).
Three segments complete the connection establishment. This is often called the three-way handshake.
It takes four segments to terminate a connection. Since a TCP connection is full-duplex (that is, data can be flowing in each direction independently of the other direction), each direction must be shut down independently. Either end can send a FIN when it is done sending data.
The receipt of a FIN only means there will be no more data flowing in that direction. A TCP can still send data after receiving a FIN. While it's possible for an application to take advantage of this half-close, in practice few TCP applications use it.
Most Berkeley-derived systems set a time limit of 75 seconds on the establishment of a new connection.
The maximum segment size (MSS) is the largest "chunk" of data that TCP will send to the other end. When a connection is established, each end can announce its MSS. The resulting IP datagram is normally 40 bytes larger: 20 bytes for the TCP header and 20 bytes for the IP header.
If the destination IP address is "nonlocal," the MSS normally defaults to 536.
TCP provides the ability for one end of a connection to terminate its output, while still receiving data from the other end. This is called a half-close.
The TIME_WAIT state is also called the 2MSL wait state. Every implementation must choose a value for the maximum segment lifetime (MSL). It is the maximum amount of time any segment can exist in the network before being discarded.
Given the MSL value for an implementation, the rule is: when TCP performs an active close, and sends the final ACK, that connection must stay in the TIME_WAIT state for twice the MSL. This lets TCP resend the final ACK in case this ACK is lost (in which case the other end will time out and retransmit its final FIN).
RFC 793 states that TCP should not create any connections for MSL seconds after rebooting. This is called the quiet time.
A RST "reset" is sent by TCP whenever a segment arrives that doesn't appear correct for the referenced connection.
A common case for generating a reset is when a connection request arrives and no process is listening on the destination port. In the case of UDP, an ICMP port unreachable was generated when a datagram arrived for a destination port that was not in use. TCP uses a reset instead.
It is possible to abort a connection by sending a reset instead of a FIN. This is sometimes called an abortive release. Aborting a connection provides two features to the application: (1) any queued data is thrown away and the reset is sent immediately, and (2) the receiver of the RST can tell that the other end did an abort instead of a normal close. The API being used by the application must provide a way to generate the abort instead of a