Connection Termination: Saying Goodbye

The connection you just established (SYN, SYN-ACK, ACK) won't last forever. When the client or server is done, they need a formal way to end the conversation and free up resources. This is known as termination.

Metaphor: Think of it like checking out of a library.

  • Graceful (FIN): You walk to the counter, return your books, wait for them to be checked in, and say goodbye.
  • Abrupt (RST): You drop the books on the floor and run out of the building.

4. TCP Termination

Because TCP is Full-Duplex (data can flow both ways at once), the teardown is a four-step process. Each side must independently say it's done.

  1. Client sends FIN: "I'm done sending data."
  2. Server sends ACK: "Got it. I'll finish my last few pieces of work."
  3. Server sends FIN: "Okay, I'm done too."
  4. Client sends ACK: "Goodbye."

Half-Close State: After Step 2, the connection is "Half-Closed." The client can't send, but the server can still send data until it issues its own FIN.

Sometimes, a connection needs to die immediately. For this, we use the RST (Reset) flag. Nickname: The Rude Hangup.

When is RST sent?

  • Closed Port: If you try to connect to a port that has no service, the OS sends an RST back.
  • Application Crash: If the program handling the connection crashes, the OS sends RST to clean up.
  • Malicious Kill: Attackers can send fake RST packets to disrupt someone else's connection (DDoS).

The "FIN Scan" trick: Attackers send a FIN to a port. If it's open, the server ignores it (it's not expecting a close for a non-existent session). If it's closed, the OS sends an RST. This is a stealthy way to find open ports.

TCP is complex, and connections can get "stuck" in a half-open state.

Half-Open Connections: A state where the server has sent a SYN-ACK but never received the final ACK. This consumes memory until it times out.

Defensive Move: Admins should increase the backlog queue size and enable SYN Cookies to prevent these "stuck" connections from crashing the server.

🔍 Cybersecurity Insight: Packet Analysis

In a packet capture (PCAP), seeing a FIN sequence usually means a normal user exit. Seeing a sudden RST often means a network error, a firewall intervention, or an attacker trying to hide their tracks.

📚 Sources & References

  • RFC 793: Joint TCP/IP Termination standards.
  • Nmap Documentation: FIN vs RST scanning mechanics.
  • MITRE ATT&CK T1499.001: Connection Impairment.