Actually this depends on the endsystem implementation.
There are 2 kinds of packets that can come across the wire:
- A packet with the RST bit set. This indicates a crash.
- A packet with the FIN bit set. This indicates normal close.
But some endsystems will send FIN when the socket is closed, no matter
why it is closed; this you cannot detect.
Test with an UNIX box: Put a TCPDUMP on your LAN, telnet to some remote
host, and kill the telnet client in various ways (kill -HUP, kill -9,
EOF from client....), and see if the trace shows an R or an F in the
last packet sent. If it's an F, the close is "normal".
Harald A
-- Harald Tveit Alvestrand, Maxware, Norway Harald.Alvestrand@maxware.no