Visual Learning · 01 · Live
TCP Connection Teardown
Four-way close: FIN → ACK → FIN → ACK — each direction shuts down separately.
CYNARKS|Cyber Flow Explorer
Teaching simulation · not live capture
TCP Connection Teardown
Lab hosts only.
Real world · Browsers and APIs close idle TCP sockets with FIN; abrupt kills use RST instead.
Attack · Forged FINs/RSTs can disrupt sessions (TCP reset attacks) — out of scope here.
Defense · Stateful firewalls track ESTABLISHED and tear-down sequences.
- Control · Prefer graceful FIN close for application shutdown
- Control · Alert on unusual RST floods
- Control · Do not expose raw sockets to untrusted networks
1. FIN+ACK
Client
192.168.1.10:52344FIN + ACK
seq=1001 ack=5001
Server
10.0.0.5:80Client has no more data — sends FIN. Moves toward FIN-WAIT-1.
seq=1001 ack=5001
- #1 client → server FIN+ACK seq=1001 ack=5001
Space · ← → · R restart