GSEC · Question #53
What is the following sequence of packets demonstrating?
The correct answer is C. client.com.38060 > telnet.com.telnet: F 92:92(0) ack 4290 win 8760 (DF). The packet sequence demonstrates a TCP four-way connection termination, and the correct answer identifies the specific packet in which the client sends its FIN to close its half of the connection.
Question
What is the following sequence of packets demonstrating?
Options
- Atelnet.com.telnet > client.com.38060: F 4289:4289(0) ack 92 win 1024
- Bclient.com.38060 > telnet.com.telnet: .ack 4290 win 8760 (DF)
- Cclient.com.38060 > telnet.com.telnet: F 92:92(0) ack 4290 win 8760 (DF)
- Dtelnet.com.telnet > client.com.38060: .ack 93 win 1024
How the community answered
(52 responses)- A8% (4)
- B4% (2)
- C75% (39)
- D13% (7)
Why each option
The packet sequence demonstrates a TCP four-way connection termination, and the correct answer identifies the specific packet in which the client sends its FIN to close its half of the connection.
This packet shows telnet.com (the server) sending the initial FIN to the client, meaning it represents the server-initiated half-close, not the client's FIN.
This packet shows client.com sending only an ACK (dot notation indicates no FIN flag) to acknowledge the server's FIN - it does not itself initiate the client-side connection close.
Packet C shows client.com sending a FIN segment (F flag) to telnet.com, which is the client initiating the closure of its side of the TCP connection. In a TCP graceful close, after the client acknowledges the server's FIN in packet B, it must send its own FIN segment to complete the four-way termination handshake - this is exactly what packet C represents with sequence number 92 and the F flag set.
This packet shows telnet.com sending an ACK for sequence 93 to acknowledge the client's FIN, completing the four-way close from the server side, not initiating the client-side close.
Concept tested: TCP four-way connection termination FIN handshake
Source: https://www.rfc-editor.org/rfc/rfc793
Topics
Community Discussion
No community discussion yet for this question.