This question is marked "community wiki".
asked 06 Jan '17, 03:14
edited 06 Jan '17, 03:52
We have a client (10.160.119.23) and a server (172.16.1.242). The client made an HTTPS request, which is not shown in the trace file.
The client acknowledges the arrival of data [Ack=1179, while the ACK flag is set] and want's to terminate the connection [RST].
Data is still in transit from the server, while the RST is on it's way (packets 974 and 976). As the client has already closed it's socket the two data segments trigger extra Resets.
A graceful TCP shutdown would require 4 packets:
Terminating the connection makes sure, that the server will not send data after the client tells about the desire to terminate the connection.
answered 06 Jan '17, 09:41