WebSocket close opcode

Question

When I close() my websocket connection on the client side (FF) and debug my server side to see the incoming data, which I converted to hex to read it, I receive something like "8880825d04de" (still masked). On every close attempt I receive similar data "8880XXXXXX".

The mask should be "825d04de" because it changes each time and the RFC tells me that the close message of the client is masked. The 8880 confuses me because in the RFC the opcode which should indicate a close message is 0x8.

Could anyone explain this to me?

Answer 1

Well, I'm guessing it breaks down like this:

8 - FIN
8 - close opcode
8 - MASK + 3 bits of 0 for payload length
0 - 4 bits of 0 for payload length