Re: Logging unserved ports

Philip Blundell (philb@gnu.org)
Sat, 12 Dec 1998 15:51:00 +0100


>My understanding is, roughly, FINs are used to close an ESTABLISHED
>connection, which means SYN should no longer be set. If SYN (or SYN+ACK)
>is received for a socket not yet in ESTABLISHED state, and there is no
>listener or whatnot, RST should be sent, not FIN (nor SYN). If there are
>conditions in which FIN+SYN is valid, please enlighten me :)

Roughly, FIN means "I have no more data to send" and SYN means "this is the
first packet of a new connection". It's probably valid to have SYN and FIN
both set if you only have less than one MSS-worth of data to transmit, but
this is a pretty unlikely circumstance to occur. I think transaction TCP
works this way but I'm not sure.

>This does remind me of one other question, though: is FIN+RST (w/ or w/o
>ACK set) ever a valid combination? I tend to think not (by pretty much the

No. RST combined with SYN or FIN isn't a sensible thing to send. A RST
causes the connection to be immediately torn down and this is incompatible
with either gracefully closing it or initiating a new one. :-)

RST+ACK is valid though.

p.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/