zeek/testing/btest/Traces/tcp/fin_retransmission.pcap
Jon Siwek 5b3573394e Improve TCP FIN retransmission handling.
In the case multiple FIN packets are seen from a TCP endpoint (e.g.
when one is retransmitted), only the first counted towards a byte in the
sequence space.  This could cause a subsequent FIN packet to induce an
incorrect wrap around in the sequence numbers (e.g.  the retransmitted
FIN packet now is one sequence number behind the the first) and
misleadingly large connection sizes.  The change is to always treat a
FIN packet as counting one byte in to the sequence space.
2014-01-24 15:51:58 -06:00

434 B