<DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">I have a TCP client which does a HTTP-POST to IIS 5.0 / 6.0. When the webserver completes sending data, it does an active close and moves into the FIN_WAIT_2.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">By this time, the client is still reading the data from the socket buffer. After a timeout, IIS is sends a RST to the client TCP. This stops the client from reading the data from the buffer. read() errors out with a ECONNRESET.</SPAN></FONT><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">My question is, "Why does the Windows TCP stack send an RST when in FIN_WAIT_2 ? Is this an intended behaviour ?"</SPAN></FONT><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Just thought I will attach the TCP dump of the communication:</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">tcpdump: listening on lan0</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial"></SPAN></FONT><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.866196 forti.58705 > mustangrr.http: S 3780990706:3780990706(0) win 32768 <mss 1460,wscale 0,nop> (DF)</SPAN></FONT></P>
<P class=MsoNormal dir=ltr style="MARGIN-RIGHT: 0px"><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial"></SPAN></FONT><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.867048 mustangrr.http > forti.58705: S 1452070376:1452070376(0) ack 3780990707 win 17520 <mss 1460,nop,wscale 0> (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.867336 forti.58705 > mustangrr.http: P 1:163(162) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.867508 forti.58705 > mustangrr.http: P 163:204(41) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.867547 forti.58705 > mustangrr.http: P 204:262(58) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.867572 forti.58705 > mustangrr.http: P 262:303(41) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868047 forti.58705 > mustangrr.http: P 303:357(54) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868071 forti.58705 > mustangrr.http: P 357:398(41) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868097 forti.58705 > mustangrr.http: P 398:457(59) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868123 forti.58705 > mustangrr.http: P 457:498(41) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868156 forti.58705 > mustangrr.http: P 498:623(125) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868188 forti.58705 > mustangrr.http: P 623:664(41) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868214 forti.58705 > mustangrr.http: P 664:718(54) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868244 forti.58705 > mustangrr.http: P 718:761(43) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.868275 forti.58705 > mustangrr.http: P 761:762(1) ack 1 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.869140 mustangrr.http > forti.58705: . ack 204 win 17317 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.869166 mustangrr.http > forti.58705: . ack 303 win 17218 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.869228 mustangrr.http > forti.58705: . ack 398 win 17123 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.869296 mustangrr.http > forti.58705: . ack 498 win 17023 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.872038 mustangrr.http > forti.58705: . ack 664 win 16857 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.872061 mustangrr.http > forti.58705: . ack 761 win 16760 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.887618 mustangrr.http > forti.58705: P 1:228(227) ack 762 win 16759 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.888503 mustangrr.http > forti.58705: FP 228:780(552) ack 762 win 16759 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.888537 forti.58705 > mustangrr.http: . ack 781 win 32768 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.888559 mustangrr.http > forti.58705: R 1452071157:1452071157(0) win 0 (DF)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">17:44:38.888884 mustangrr.http > forti.58705: R 1452071157:1452071157(0) win 0<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">12431 packets received by filter<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=1><SPAN style="FONT-SIZE: 8pt; FONT-FAMILY: Arial">0 packets dropped by kernel<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">I could not figure out why on earth Windows TCP sends an RST, but however it was a simple fix for me in my application. <o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">The client now sends Keep-Alives so that, the web svr which by definition does a active close will not do so. This allows my client to keep the connection alive and do the active close when its done with its job.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">I did post this into Microsoft IIS newsgroups, it wasnt of any use.</SPAN></FONT><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Found a similar article posted in 2003 :-</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><A title=http://www.postel.org/pipermail/end2end-interest/2003-January/002599.html href="http://www.postel.org/pipermail/end2end-interest/2003-January/002599.html">http://www.postel.org/pipermail/end2end-interest/2003-January/002599.html</A><o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Regards,<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Goutham S Mohan<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">---------------------------<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Software Engineer, <o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Hewlett Packard [Global <?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" /><st1:place w:st="on"><st1:PlaceName w:st="on">Delivery</st1:PlaceName> <st1:PlaceName w:st="on">India</st1:PlaceName> <st1:PlaceType w:st="on">Center</st1:PlaceType></st1:place>]<o:p></o:p></SPAN></FONT></P></DIV></DIV><p>
<hr size=1>Do you Yahoo!?<br>
<a href="http://us.rd.yahoo.com/mail_us/taglines/virus/*http://promotions.yahoo.com/new_mail/static/protection.html">Yahoo! Mail</a> - Helps protect you from nasty viruses.