Ethereal-users: Re: [Ethereal-users] What does the flag [FIN, PUSH, ACK] mean????

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 15 Sep 2004 10:29:00 -0700
Jack Jackson wrote:

I can't tell if that is correct since you haven't specified which messages are sent and which are received. The normal termination sequence for a TCP connection when all data has been sent is 3 messages:

...but, at least as I read RFC 793, it's permissible to send data in a FIN segment:

  We have taken advantage of the numbering scheme to protect certain
  control information as well.  This is achieved by implicitly including
  some control flags in the sequence space so they can be retransmitted
  and acknowledged without confusion (i.e., one and only one copy of the
  control will be acted upon).  Control information is not physically
  carried in the segment data space.  Consequently, we must adopt rules
  for implicitly assigning sequence numbers to control.  The SYN and FIN
  are the only controls requiring this protection, and these controls
  are used only at connection opening and closing.  For sequence number
  purposes, the SYN is considered to occur before the first actual data
  octet of the segment in which it occurs, *while the FIN is considered
  to occur after the last actual data octet in a segment in which it
  occurs*.  The segment length (SEG.LEN) includes both data and sequence
  space occupying controls.  When a SYN is present then SEG.SEQ is the
  sequence number of the SYN.

(end of page 26 - emphasis mine).

Presumably if some data is written to a socket and the socket is then closed, a TCP implementation could send out the data in a segment and set FIN on that segment, which means that the data in that segment is the last data that will be sent by that peer on that connection.