"simultaneous" close on both ends. column 1 is relative time: 000050 freebsd.28411 > linux.14001: F 6486:6486(0) ack 232 000031 linux.14001 > freebsd.28411: F 232:232(0) ack 6486 000333 linux.14001 > freebsd.28411: . ack 6487 [linux 200ms retransmit] 200490 linux.14001 > freebsd.28411: F 232:232(0) ack 6487 000011 freebsd.28411 > linux.14001: . ack 233 It seems like we're doing something wrong here: "A simultaneous CLOSE by users at both ends of a connection causes FIN segments to be exchanged. When all segments preceding the FINs have been processed and acknowledged, each TCP can ACK the FIN it has received." Our fin was acked, but we didn't ack theirs.. so they retransmitted after 200ms and only then we acked it.