At 07:35 20.04.98 -0700, Turner, Randy wrote:
><RT> This is not true in all cases. I seem to remember that some socket
>and TLI API implementations allow you to detect the difference between a
>remote endsystem crashing and a normal connection "close". This should
>be especially possible if the client had data in transit at the time the
>remote endsystem crashed.
Actually this depends on the endsystem implementation.
There are 2 kinds of packets that can come across the wire:
- A packet with the RST bit set. This indicates a crash.
- A packet with the FIN bit set. This indicates normal close.
But some endsystems will send FIN when the socket is closed, no matter
why it is closed; this you cannot detect.
Test with an UNIX box: Put a TCPDUMP on your LAN, telnet to some remote
host, and kill the telnet client in various ways (kill -HUP, kill -9,
EOF from client....), and see if the trace shows an R or an F in the
last packet sent. If it's an F, the close is "normal".
Harald A
--
Harald Tveit Alvestrand, Maxware, Norway
Harald.Alvestrand at maxware.no