[e2e] Data + FIN

[Richard Wendland]

> As to *how frequently* it happens, somebody with ready access
> to packet traces can better answer that question.  Two years ago,
> Anja Feldman gave me a number that was (I believe) on the order 
> of 40% of TCP connection were doing this, based on a packet trace 
> from AT&T.

I analysed some sample traces I have from the monthly Netcraft Web Server
Survey, which shows about 80% of FIN segments carry data on connections
transferring over 4096 bytes of data in that direction.  But when the
connection carries little data it is dramatically less, about 1.3%
for connections carrying 1024 bytes or less data, eg a HTTP HEAD response.

This fits in well with your suggestion that only when data queues on the
host is the FIN usually piggybacked onto the last data segment.  The 80%
result suggests most, if not all, server OSs are capable of piggybacked
FIN onto data segments in some circumstances.

Caveats: my analysis only considers the HTTP response side of each
connection, not the short GET/HEAD request side.  The analysis is
of connections to web servers at different IP addresses from a single
FreeBSD RFC1323 enabled client system.  But since I only look at the HTTP
response direction, that would be observing TCP from a wide variety of
web servers and OSs.

I looked at the last 10 monthly surveys, >4096 byte transfers varied from
76.9% to 84.1% between months, with no particular trend over time, and
<=1024 byte transfers from varied from 1.0% to 2.0%.  The traces analysed
had 47,000 >4096 byte transfers and 445,000 <=1024 byte transfers.

The way the samples are selected isn't properly random, so this
isn't truly representative of public web servers as a whole - but I'd
expect this to be reasonably indicative of higher latency connections.
Low latency connections might behave quite differently of course, as
data might queue less.

	Richard
-- 
					http://www.netcraft.com/survey/
Richard Wendland			richard at netcraft.com