Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Question on Fin/ack

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Mon, 26 Mar 2007 12:56:47 -0700
At 12:52 PM 3/26/2007, Jack Jackson wrote:
At 10:24 AM 3/26/2007, Jamie Crawford wrote:
>Hello,
>I've got a application that probes a wireless printer to make sure it can
>communicate over tcp 6101.  Once that it sees that it can communicate over
>that port, it will then send it's print job.  But for some reason, the
>printer hangs up and won't accept any more connections for 60 seconds.
>Heres what the conversation looks like.  Should the server just send a
>fin,ack to kill the session off?  I figured you would first send a fin,
>and then get a fin,ack back from the printer?
>
>
>server 29515 -> printer 6101 syn
>printer 6101 -> server 29515 syn,ack
>server 29515 -> printer 6101 ack
>server 29515 -> printer 6101 fin,ack
>server 29517 -> printer 6101 syn
>printer 6101 -> server 29515 ack (TCP ZEROWINDOW)
>printer 6101 -> server 29517 rst,ack
>server 29517 -> printer 6101 syn
>printer 6101 -> server 29517 rst,ack
>server 29517 -> printer 6101 syn
>printer 6101 -> server 29517 rst,ack
>server 29517 -> printer 6101 syn
>printer 6101 -> server 29517 rst,ack
>server 29517 -> printer 6101 syn
>
>start over..same cycle....

Perhaps the print server won't let you start another connection when the
first connection hasn't been terminated.

When you send the second syn, the first connection has not been terminated
- the print server hasn't acked your fin (it does later) and hasn't sent
fin to terminate the other half of the conversation.  I don't know why the
print server doesn't send fin.  Maybe it never expects to get a connection
with no data or maybe the syn confuses it.

What happens if you don't send the second fin - does the print server
eventually close the first connection properly?  If so, you could wait for
that to happen.  Or you could try sending it a rst to force the connection
closed.

I meant to say:
What happens if you don't send the second syn