Tearing down a connection
When a TCP connection is complete, TCP tears down the connection by exchanging a series of FIN packets, closing the port, and refusing any more requests to communicate. Let's walk through the entire process.
When two hosts are communicating, a TCP conversation goes through several stages:
- TCP starts with a (three-way) handshake to set up the session. In many cases, there are additional header options that further define the parameters.
- During the conversation, TCP monitors the communication and acknowledges all bytes received to ensure the complete delivery of the data.
- Once the conversation is over, TCP ends the session with an exchange of FIN packets between the two endpoints, which indicates that the session is complete.
Let's now take a look at how session teardown is represented in Wireshark.
In the Flows312.pcapng capture, packets 6, 7, 8, and 9 represent the session teardown, as shown here:
