nerdexam
GIAC

GSEC · Question #53

What is the following sequence of packets demonstrating?

The correct answer is C. client.com.38060 > telnet.com.telnet: F 92:92(0) ack 4290 win 8760 (DF). The packet sequence demonstrates a TCP four-way connection termination, and the correct answer identifies the specific packet in which the client sends its FIN to close its half of the connection.

Networking and Core Concepts

Question

What is the following sequence of packets demonstrating?

Options

  • Atelnet.com.telnet > client.com.38060: F 4289:4289(0) ack 92 win 1024
  • Bclient.com.38060 > telnet.com.telnet: .ack 4290 win 8760 (DF)
  • Cclient.com.38060 > telnet.com.telnet: F 92:92(0) ack 4290 win 8760 (DF)
  • Dtelnet.com.telnet > client.com.38060: .ack 93 win 1024

How the community answered

(52 responses)
  • A
    8% (4)
  • B
    4% (2)
  • C
    75% (39)
  • D
    13% (7)

Why each option

The packet sequence demonstrates a TCP four-way connection termination, and the correct answer identifies the specific packet in which the client sends its FIN to close its half of the connection.

Atelnet.com.telnet > client.com.38060: F 4289:4289(0) ack 92 win 1024

This packet shows telnet.com (the server) sending the initial FIN to the client, meaning it represents the server-initiated half-close, not the client's FIN.

Bclient.com.38060 > telnet.com.telnet: .ack 4290 win 8760 (DF)

This packet shows client.com sending only an ACK (dot notation indicates no FIN flag) to acknowledge the server's FIN - it does not itself initiate the client-side connection close.

Cclient.com.38060 > telnet.com.telnet: F 92:92(0) ack 4290 win 8760 (DF)Correct

Packet C shows client.com sending a FIN segment (F flag) to telnet.com, which is the client initiating the closure of its side of the TCP connection. In a TCP graceful close, after the client acknowledges the server's FIN in packet B, it must send its own FIN segment to complete the four-way termination handshake - this is exactly what packet C represents with sequence number 92 and the F flag set.

Dtelnet.com.telnet > client.com.38060: .ack 93 win 1024

This packet shows telnet.com sending an ACK for sequence 93 to acknowledge the client's FIN, completing the four-way close from the server side, not initiating the client-side close.

Concept tested: TCP four-way connection termination FIN handshake

Source: https://www.rfc-editor.org/rfc/rfc793

Topics

#TCP teardown#FIN packets#connection termination#packet analysis

Community Discussion

No community discussion yet for this question.

Full GSEC Practice