Not speaking the same language



  • While trying to diagnose a network problem, I came across something interesting:



    The end of an HTTP conversation, as terminated by a web server:

    15:21:42.330161 IP 192.168.17.27.80 > 192.168.17.34.55208: F 4641:4641(0) ack 402 win 65535 <nop,nop,timestamp 389280224 1507587355>
    15:21:42.330184 IP 192.168.17.34.55208 > 192.168.17.27.80: . ack 4642 win 65535 <nop,nop,timestamp 1507587355 389280224>
    15:21:42.330514 IP 192.168.17.34.55208 > 192.168.17.27.80: F 402:402(0) ack 4642 win 65535 <nop,nop,timestamp 1507587355 389280224>
    15:21:42.330665 IP 192.168.17.27.80 > 192.168.17.34.55208: . ack 403 win 65535 <nop,nop,timestamp 389280224 1507587355>

    The end of an HTTP conversation,as terminated by FirstClass:
    15:19:37.867176 IP 192.168.17.26.8080 > 192.168.17.34.55192: F 11158:11158(0) ack 759 win 32768 <nop,nop,timestamp 1644170639 1507587103>
    15:19:37.867205 IP 192.168.17.26.8080 > 192.168.17.34.55192: R 11159:11159(0) ack 759 win 32768
    15:19:37.867262 IP 192.168.17.34.55192 > 192.168.17.26.8080: . ack 11159 win 65535 <nop,nop,timestamp 1507587107 1644170639>
    15:19:37.867457 IP 192.168.17.26.8080 > 192.168.17.34.55192: R 1441238341:1441238341(0) win 0

    Am I correct that FirstClass is speaking a different dialect of TCP here?


  • The first one is an orderly double-half-close (sloppy but valid). The second one is a half-duplex close, where the 192.168.17.26 application closed the session without bothering to read all the data sent by its peer, so its host operating system sends a RST to let the other end know about the error condition.



  • See also "man 3 shutdown" for more.

     



  • @asuffield said:

    The first one is an orderly double-half-close (sloppy but valid). The second one is a half-duplex close, where the 192.168.17.26 application closed the session without bothering to read all the data sent by its peer, so its host operating system sends a RST to let the other end know about the error condition.

     It feels like we're talking about a wrestling match here...shoulda tried the piledriver close imo
     


Log in to reply
 

Looks like your connection to What the Daily WTF? was lost, please wait while we try to reconnect.