http - Wireshark 显示 http 只有三波不是四波数据转换

Question

当我是学生时，被教导停止 http 连接有 4 个过程。但是今天我只测试了 3 个进程。是 Wireshark 合并数据转换？

标签： httpwireshark

Answer 1

You were likely taught that TCP connections require a four way close: FIN/ACK -> ACK, FIN/ACK -> ACK. This is true, but it does not have to take four packets to do it.

In the case that you present, the 192.168.0.106 host begins to close with a FIN/ACK. The other end of the connection, rather than simply ACKing this, takes the opportunity to begin closing as well. So, when it responds with a FIN/ACK, it is both ACKing the FIN that it received and beginning its own close. The final packet is the acknowledgement of the FIN from the 211 host.

What this means is that, in this case, only three packets were used, but we still had a FIN from host A that was acknowledged and a FIN from host B that was acknowledged. That is really the only requirement in the protocol.