Finish
TCP FIN (Finish, bit 7) signals that the sender has finished sending data. FIN initiates a graceful connection close. Unlike RST which aborts immediately, FIN allows the other side to finish sending its data before the connection fully closes. A complete close requires FIN from both sides.
Abbreviation
FIN
Bit Position
7
tcpdump
[F]
Standard
RFC 9293
Description
TCP's graceful close requires a four-way termination. One side sends FIN signaling it has no more data to send. The other side ACKs the FIN (the receive half closes). The other side then finishes sending its own data and sends its own FIN. The first side ACKs this second FIN and enters TIME_WAIT.
TIME_WAIT state lasts 2*MSL (Maximum Segment Lifetime, typically 60-120 seconds) and prevents delayed packets from a closed connection from being misinterpreted as belonging to a new connection on the same port tuple. TIME_WAIT is commonly misunderstood as a problem – it is a correct and necessary TCP behavior.
Half-close: a side that has sent FIN can still receive data from the other side. This is valid in protocols like HTTP/1.0 where the client sends its request, sends FIN (half-close), and then reads the response. The server can continue sending after the client's FIN.
Key Flag Combinations
| Flags | Meaning |
|---|---|
| FIN+ACK | Graceful close – most common form, combines FIN with ACK of previous data |
| FIN+PSH+ACK | Final data segment with connection close |
When You See This Flag
- –Application called close() or shutdown(SHUT_WR) on the socket
- –HTTP/1.1 server closing connection after response with Connection: close
- –TCP keepalive failure triggering connection close
- –Process exiting, OS sending FIN on all open sockets