Wireshark · Wireshark-users: Re: [Wireshark-users] RST flag at end of TCP transmission

[Sake Blok <sake@xxxxxxxxxx>]

On 3 mei 2010, at 17:32, Jeff Bruns wrote:

> Thank you for your reply. As suggested, I've attached the wireshark dump file for the TCP transmission in question. 

As you said, this looks like a normal completed TCP session, except for the ending of it.

In frame 16, the client sends the final data to the printer and sets the FIN flag to tell the printer it wants to end the session. That FIN is ACKed in frame 19, the printer has seen the FIN, otherwise it would have sent an ACK of 3898 instead of 3899. In frame 21 it sends its own FIN back to the client, however, this FIN is not ACKed by the client. In frame 22 the printer retransmits it's FIN, but by now, the client does not have the session open any more, so it sends back a RST to the printer.

So what could be the problem? First of all, why does the printer send its FIN 2 seconds after receiving the FIN from the client. This however should not directly be  problem. What is a problem is that the client does not send an ACK after receiving the FIN from the printer.

Hope this helps,
Cheers,
     Sake