FIN (Finish)
FIN is a TCP flag used to gracefully close a connection. TCP close is a four-way process: FIN from initiator, ACK from peer, FIN from peer, ACK from initiator. The TIME_WAIT state after closing lasts 2*MSL (typically 60s) to handle delayed packets – this can exhaust ports on busy servers.
Definition
The FIN flag signals that the sender has no more data to transmit. TCP close is half-duplex – each direction closes independently. The initiator sends FIN, the peer ACKs it (the peer can still send data). When the peer finishes, it sends its own FIN, which gets ACKed. The initiator then enters TIME_WAIT for 2*MSL (Maximum Segment Lifetime, typically 60 seconds) to handle any delayed packets that might arrive after close. On high-traffic servers (load balancers, proxies), TIME_WAIT sockets can exhaust available local ports. Mitigations include: tcp_tw_reuse (allows reuse of TIME_WAIT sockets for new outgoing connections), SO_LINGER with timeout 0 (sends RST instead of FIN – abrupt close), and connection pooling to avoid frequent open/close cycles.
Examples
- –ss -o state time-wait | wc -l – count TIME_WAIT sockets
- –sysctl net.ipv4.tcp_tw_reuse=1 – allow TIME_WAIT reuse for outgoing
- –shutdown(fd, SHUT_WR) sends FIN while keeping read half open
Related Protocols
Related Terms
ACK (Acknowledgment)
ACK (acknowledgment) is a TCP flag confirming receipt of data. The ACK number indicates the next byte the receiver expects. Delayed ACKs batch confirmations for efficiency (typically every 2 segments or 200ms). Missing ACKs trigger retransmission – the sender assumes data was lost.
SYN (Synchronize)
SYN is a TCP flag used to initiate a connection via the three-way handshake: SYN, SYN-ACK, ACK. The SYN packet carries the client's initial sequence number (ISN). SYN floods are a classic DDoS attack that exhausts server connection tables by sending SYNs without completing handshakes.
Four-Way Teardown
TCP four-way teardown (FIN, ACK, FIN, ACK) gracefully closes a connection. Each side independently signals it has no more data (FIN) and acknowledges the other's FIN. The initiator enters TIME_WAIT for 2*MSL (60-120s) after close, consuming a socket until the timer expires.
Keep-Alive
Keep-alive has two meanings: TCP keep-alive sends periodic probes on idle connections to detect dead peers (default: 2 hours). HTTP keep-alive (Connection: keep-alive) reuses a TCP connection for multiple requests, avoiding repeated handshake overhead. Both reduce connection churn but serve different purposes.