1

I was capturing some HTTP traffics and I observed a packet with the FIN flag set and also containing payload data.

I searched for this topic and I found some similar questions but none of them talking about the next sequence number and RFC references for this situation.

similar question

My question is that what should be the next sequence number after packet with the FIN flag set containing payload?

In other words, what should be the ACK number of the packet which is the response of the active opener's FIN packet? What acknowledgment number should the response packet have, while the sender of FIN packet, has a payload, too?

--> <SEQ=100><ACK=300><CTL=FIN,ACK> : payload length = 20 bytes

<-- <SEQ=300><ACK=X><CTL=FIN,ACK>

--> <SEQ=X><ACK=301><CTL=ACK>

Is X 101, 120, or 121?

Do RFC clearly talks about this scenario?

I also searched for that in RFC 793 but I didn't find a clear explanation for my question.

mrazimi
  • 121
  • 6

2 Answers2

1

I am not 100% sure, but this is how I understand it:

On second packet, SEQ=300 and ACK=120, therefore acknowledging the payload.

On third packet, SEQ=121, because sending the ACK is considered one byte payload, similar to what happens in the three-way handshake when opening the connection.

Tero Kilkanen
  • 34,499
  • 3
  • 38
  • 58
  • 1
    You know when the first packet is sent, it has only a specific expected sequence number and that should be `X`; I think `X` should not change between the second and the third packet. Actually, I have seen some HTTP packets with the `Not Found` response that occurs like the above scenario, such that the passive opener (the second packet) acknowledges both payload and FIN; But I want to be sure about or find some references confirms or rejects this. – mrazimi Jul 14 '19 at 04:43
1

RFC 793 indicates that SYN and FIN control flags occupy one sequence number.

In the GLOSSARY it's written about FIN control flag that:

FIN

A control bit (finis) occupying one sequence number, which indicates that the sender will send no more data or control occupying sequence space.

So it can be realized that the value of X should be 121 if the second packet is acknowledging the first packet.

mrazimi
  • 121
  • 6