Question : Confirmation of TCP/IP connection states

Hi All

I am learning about networking and was hoping someone could confirm a few things for me.

From what I understand, clients establish connections in TCP using the three way handshake.

SYN [client to server]
SYN-ACK [server to client]
ACK [client to server]

When either side wants to close the connection (AKA tear-down), the following happens (in this example, let's say the client wants to close the connection)

FIN [client to server]
FIN-ACK [server to client]
ACK [client to server]

Let's say for example that I was looking at a network trace of a communication thread between DeviceA and DeviceB. If a FIN was sent by DeviceA, would it be correct to say that it is DeviceA that is asking to close the connection?

Or do devices sometimes send FIN packets if they haven't heard from the other side for a period of time? The reason I ask is that I am looking at a network trace where DeviceA is sending a FIN to DeviceB....and the problem is that this connection should really be up all the time.

Answer : Confirmation of TCP/IP connection states

Typically 2 hosts that are communicating and one host wants to terminate the session, at most, a four-way handshake is utilized. Each side of the connection would terminate the session independently. To answer your question, yes, if DeviceA wishes to end the connection, it transmits a FIN packet, which the other end acknowledges with an ACK. Therefore, a typical tear-down requires a pair of FIN and ACK segments from each TCP endpoint.

1. (DeviceA) --> ACK/FIN --> (DeviceB)

2. (DeviceA) <-- ACK <-- (DeviceB)

3. (DeviceA) <-- ACK/FIN <-- (DeviceB)

4. (DeviceA) --> ACK --> (DeviceB)


You should also know that it is possible to terminate the connection by a 3-way handshake, when host A sends a FIN and host B replies with a FIN & ACK (merely combines 2 steps into one) and host A replies with an ACK. This is the most common method that I have seen.

Hope this helps
Billy