02-02: Exercises¶
Question¶
Below is a simplified capture of a TCP conversation between Host A (192.168.1.10) and Host B (192.168.1.20), showing only the flags and the SEQ/ACK numbers.
| # | Source → Destination | Flags | SEQ | ACK |
|---|---|---|---|---|
| 1 | A → B | SYN | 1000 | — |
| 2 | B → A | SYN, ACK | 4000 | 1001 |
| 3 | A → B | ACK | 1001 | 4001 |
| 4 | A → B | PSH, ACK (50 bytes) | 1001 | 4001 |
| 5 | B → A | ACK | 4001 | 1051 |
| 6 | A → B | FIN, ACK | 1051 | 4001 |
| 7 | B → A | ACK | 4001 | 1052 |
| 8 | B → A | FIN, ACK | 4001 | 1052 |
| 9 | A → B | ACK | 1052 | 4002 |
For each packet, identify what is happening, and state whether the connection closes gracefully.
Solution¶
Packets 1–3: Connection setup (three-way handshake)¶
- #1 (SYN): Host A initiates a connection, proposing ISN = 1000.
- #2 (SYN, ACK): Host B proposes its own ISN = 4000 and acknowledges A's SYN (ACK = 1001 = A's SEQ + 1, since SYN counts as 1).
- #3 (ACK): Host A acknowledges B's SYN (ACK = 4001 = B's SEQ + 1). The connection is now ESTABLISHED.
Packet 4: Data transfer (A → B)¶
- #4 (PSH, ACK, 50 bytes): Host A sends 50 bytes of application data. SEQ stays at 1001 (unchanged since the handshake, because the previous packet carried no data). PSH tells B's TCP stack to push the data up to the application immediately rather than buffering it.
Packet 5: Acknowledgment of data¶
- #5 (ACK): Host B acknowledges receipt of the 50 bytes. ACK = 1001 + 50 = 1051, confirming all 50 bytes arrived. B's own SEQ (4001) is unchanged since B sent no new data.
Packets 6–9: Connection teardown (four-way FIN handshake)¶
- #6 (FIN, ACK): Host A has no more data to send and initiates closure. Since FIN consumes 1 sequence number, this packet's SEQ (1051) will require an ACK of 1052.
- #7 (ACK): Host B acknowledges A's FIN (ACK = 1051 + 1 = 1052). At this point B has acknowledged A's side closing, but B may still have data to send (this is the "half-close" state) — here B doesn't, so it proceeds directly to closing too.
- #8 (FIN, ACK): Host B now also has no more data and sends its own FIN. SEQ = 4001 (unchanged since packet #5).
- #9 (ACK): Host A acknowledges B's FIN (ACK = 4001 + 1 = 4002). The connection is now fully closed on both sides.
Is this a graceful close?¶
Yes. Both sides sent a FIN and received an ACK for it (A's FIN acknowledged in #7, B's FIN acknowledged in #9), with no RST packets anywhere in the trace. This is the standard four-way FIN/ACK teardown, indicating an orderly, graceful connection close rather than an abrupt reset.
Final Answer¶
| # | What's happening |
|---|---|
| 1–3 | Three-way handshake — connection established (ISNs 1000 and 4000 exchanged) |
| 4 | Host A sends 50 bytes of data (PSH pushes it to the application layer) |
| 5 | Host B acknowledges the 50 bytes (ACK = 1051) |
| 6 | Host A initiates teardown with FIN |
| 7 | Host B acknowledges A's FIN |
| 8 | Host B sends its own FIN to close its side |
| 9 | Host A acknowledges B's FIN — connection fully closed |
The connection closes gracefully via the standard four-way FIN/ACK handshake — no resets, and every FIN is properly acknowledged.