TCP State Question

Doug Hardie <[email protected]>
Newsgroups gmane.os.freebsd.devel.net
Message-ID <[email protected]>
I am confused about the pftop output shown below.  In both cases there are significant differences between the source and destination states.  In both cases the source is a remote client and the destination is my server.  Referring to the TCP state diagram from TCP/IP Illustrated, Volumes 1 and 2, I don't see how the two sides could get that far apart.

PR    D SRC                   DEST                 STATE   AGE   EXP  PKTS BYTES
tcp   I 202.133.61.102:18950  10.0.1.230:25         9:4    472   735    15  1296

In the case above the source is in FIN_WAIT_2.  The destination is in ESTABLISHED.  This implies that the source sent a FIN that the destination never received.  The source should then be in FIN_WAIT_1.  In order for the source to move to FIN_WAIT_2 it needed to receive an ACK from the destination.  However, if the destination had sent an ACK, it would be in CLOSE_WAIT. 

PR    D SRC                   DEST                 STATE   AGE   EXP  PKTS BYTES
tcp   I 34.141.245.225:57456  10.0.1.230:25         4:9     27   894    15  1329

In this case above, the states are reversed.  This is even more confusing as it shows the destination in FIN_WAIT_2.  However, to get there it would have to go through FIN_WAIT_1.  Both of those states are for the client, not the server.  I have not managed to catch the destination states of CLOSE_WAIT or LAST_ACK which are the server states during the connection teardown.  I only see the client states for the destination.

I will admit that I have not really dealt with the TCP internals since the early 90's where the company I worked for used the Motorola TCP/IP stack which was stripped down for use in imbedded systems.  I am sure things have changed a bit since then, but the states I am seeing seem a bit unusual and contrary to the documentation I have available.

-- Doug
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.