Learn
LoginRegister
FundamentalsBeginnerFree lab

Fundamentals · browser room

TCP Connection Teardown

Beginner65 ptsTCP/IP

Objective

See the four-step close — each direction shuts down with FIN + ACK.

Cyber Flow Explorer · 4 steps · Network / Sequence / Packet / Code.

Isolated browser lab. Practice here first — no live targets. Optional deeper practice lives in the Academy library after you finish this room.

Answer panel

Challenge workspace

Complete the room tasks, then submit here to mark the room done.

CYNARKS

Teaching simulation · not live capture

TCP Connection Teardown

Lab hosts only.

Real world · Browsers and APIs close idle TCP sockets with FIN; abrupt kills use RST instead.

Attack · Forged FINs/RSTs can disrupt sessions (TCP reset attacks) — out of scope here.

Defense · Stateful firewalls track ESTABLISHED and tear-down sequences.

  • Control · Prefer graceful FIN close for application shutdown
  • Control · Alert on unusual RST floods
  • Control · Do not expose raw sockets to untrusted networks

1. FIN+ACK

Client

192.168.1.10:52344
FIN + ACK

seq=1001 ack=5001

Server

10.0.0.5:80
Client has no more data — sends FIN. Moves toward FIN-WAIT-1.

seq=1001 ack=5001

  • #1 client → server FIN+ACK seq=1001 ack=5001

Space · ← → · R restart

Hint

Half-close: one side done, the other may still transmit.

Why this is correct

Teardown is typically FIN → ACK → FIN → ACK (four-way close).