Not speaking the same language

Carnildo

While trying to diagnose a network problem, I came across something interesting:

The end of an HTTP conversation, as terminated by a web server:

15:21:42.330161 IP 192.168.17.27.80 > 192.168.17.34.55208: F 4641:4641(0) ack 402 win 65535 <nop,nop,timestamp 389280224 1507587355>
15:21:42.330184 IP 192.168.17.34.55208 > 192.168.17.27.80: . ack 4642 win 65535 <nop,nop,timestamp 1507587355 389280224>
15:21:42.330514 IP 192.168.17.34.55208 > 192.168.17.27.80: F 402:402(0) ack 4642 win 65535 <nop,nop,timestamp 1507587355 389280224>
15:21:42.330665 IP 192.168.17.27.80 > 192.168.17.34.55208: . ack 403 win 65535 <nop,nop,timestamp 389280224 1507587355>

The end of an HTTP conversation,as terminated by FirstClass:

15:19:37.867176 IP 192.168.17.26.8080 > 192.168.17.34.55192: F 11158:11158(0) ack 759 win 32768 <nop,nop,timestamp 1644170639 1507587103>
15:19:37.867205 IP 192.168.17.26.8080 > 192.168.17.34.55192: R 11159:11159(0) ack 759 win 32768
15:19:37.867262 IP 192.168.17.34.55192 > 192.168.17.26.8080: . ack 11159 win 65535 <nop,nop,timestamp 1507587107 1644170639>
15:19:37.867457 IP 192.168.17.26.8080 > 192.168.17.34.55192: R 1441238341:1441238341(0) win 0

Am I correct that FirstClass is speaking a different dialect of TCP here?

asuffield

The first one is an orderly double-half-close (sloppy but valid). The second one is a half-duplex close, where the 192.168.17.26 application closed the session without bothering to read all the data sent by its peer, so its host operating system sends a RST to let the other end know about the error condition.

DaveK1

See also "man 3 shutdown" for more.

Bumble_Bee_Tuna

@asuffield said:

The first one is an orderly double-half-close (sloppy but valid). The second one is a half-duplex close, where the 192.168.17.26 application closed the session without bothering to read all the data sent by its peer, so its host operating system sends a RST to let the other end know about the error condition.

It feels like we're talking about a wrestling match here...shoulda tried the piledriver close imo