TCP连接的终止过程

在建立一个连接需要客户端和服务端进行三次握手，而终止一个连接需要经过4次握手。

[root@localhost /]# tcpdump -S tcp port 5210
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
18:36:14.762904 IP 192.168.1.102.49288 > 192.168.1.105.5210: S 313624018:313624018(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
18:36:14.773698 IP 192.168.1.105.5210 > 192.168.1.102.49288: S 4078776998:4078776998(0) ack 313624019 win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 7>

18:36:14.773902 IP 192.168.1.102.49288 > 192.168.1.105.5210: . ack 4078776999 win 16425
18:36:14.764642 IP 192.168.1.105.5210 > 192.168.1.102.49288: P 4078776999:4078777013(14) ack 313624019 win 46
18:36:14.765099 IP 192.168.1.105.5210 > 192.168.1.102.49288: F 4078777013:4078777013(0) ack 313624019 win 46
18:36:14.765341 IP 192.168.1.102.49288 > 192.168.1.105.5210: . ack 4078777014 win 16421
18:36:14.775762 IP 192.168.1.102.49288 > 192.168.1.105.5210: F 313624019:313624019(0) ack 4078777014 win 16421
18:36:14.775802 IP 192.168.1.105.5210 > 192.168.1.102.49288: . ack 313624020 win 46

上面最后四行，就是四个报文的发送和接收过程:

1. IP 192.168.1.105.5210 > 192.168.1.102.49288: F 4078777013:4078777013(0)，服务器端发送FIN段，主动关闭连接。
   
2. IP 192.168.1.102.49288 > 192.168.1.105.5210: . ack 4078777014，客户端应答ACK段。
   
3. IP 192.168.1.102.49288 > 192.168.1.105.5210: F 313624019:313624019(0) ack 4078777014，客户端发送FIN段。
   
4. IP 192.168.1.105.5210 > 192.168.1.102.49288: . ack 313624020，服务器应答ACK段。
   

在经过上面四个过程之后，TCP连接断开。