Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Question on Fin/ack

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Mon, 26 Mar 2007 12:52:27 -0700
At 10:24 AM 3/26/2007, Jamie Crawford wrote:
Hello,
I've got a application that probes a wireless printer to make sure it can communicate over tcp 6101. Once that it sees that it can communicate over that port, it will then send it's print job. But for some reason, the printer hangs up and won't accept any more connections for 60 seconds. Heres what the conversation looks like. Should the server just send a fin,ack to kill the session off? I figured you would first send a fin, and then get a fin,ack back from the printer?


server 29515 -> printer 6101 syn
printer 6101 -> server 29515 syn,ack
server 29515 -> printer 6101 ack
server 29515 -> printer 6101 fin,ack
server 29517 -> printer 6101 syn
printer 6101 -> server 29515 ack (TCP ZEROWINDOW)
printer 6101 -> server 29517 rst,ack
server 29517 -> printer 6101 syn
printer 6101 -> server 29517 rst,ack
server 29517 -> printer 6101 syn
printer 6101 -> server 29517 rst,ack
server 29517 -> printer 6101 syn
printer 6101 -> server 29517 rst,ack
server 29517 -> printer 6101 syn

start over..same cycle....

Perhaps the print server won't let you start another connection when the first connection hasn't been terminated.

When you send the second syn, the first connection has not been terminated - the print server hasn't acked your fin (it does later) and hasn't sent fin to terminate the other half of the conversation. I don't know why the print server doesn't send fin. Maybe it never expects to get a connection with no data or maybe the syn confuses it.

What happens if you don't send the second fin - does the print server eventually close the first connection properly? If so, you could wait for that to happen. Or you could try sending it a rst to force the connection closed.