TCP::close

Description

When TCP::close is called, the BIG-IP system sends a TCP FIN to the peer (client or server) to indicate that it will no longer send data.

  • This does not immediately tear down the connection.
  • The connection remains half-open until the peer responds with its own FIN and ACK.
  • This process is normal TCP behavior, and it allows the peer (e.g., a client) to finish sending any data it was in the process of transmitting.

The connection only fully closes after:

  • Both sides have exchanged FINs,
  • Any in-flight data has been acknowledged, and
  • The TCP connection timeout expires (or the final FIN is ACKed).

Syntax

TCP::close

What This Means for Application Behavior

  • If the peer (client or server) sends more data after the TCP::close is issued but before its own FIN, that data may still be accepted and processed depending on timing.
  • This makes it “graceful”, because the application isn’t suddenly cut off (as would happen with a reset).
  • You are not forcibly dropping the connection or rejecting the peer’s next packet (like with reject).
  • Instead, you’re signaling: “I’m done sending. You may finish up and close when ready.”

In Contrast: reject

This command causes the BIG-IP to immediately reset the connection using a TCP RST, which:

  • Tells the peer: “Something went wrong, forget this connection.”
  • Causes an abrupt closure – data in transit may be lost.
  • Is usually used in error conditions or security enforcement.

Example of How TCP::close Might Delay Full Closure

If you issue TCP::close during a request handling (e.g., HTTP_REQUEST), and the client starts sending another request or HTTP pipelining is in play, the connection won’t fully close until the peer stops and sends its FIN. So the closure can be delayed.

This behavior allows for graceful application-layer termination and can be useful when you want to complete a message exchange but don’t want to allow new requests on the same connection.

Examples

when HTTP_REQUEST {
   set my_loc "http://www.i-want-a-bigip-for-christmas.com"
   TCP::respond "HTTP/1.1 302 Found\r\nLocation: $my_loc\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
   TCP::close
}