TCP
The Transmission Control Protocol (TCP) is a connection-oriented, reliable, byte-stream transport protocol formalized in September 1981 by RFC 793. It provides ordered, error-checked delivery of data between applications running on hosts communicating over an IP network.
The TCP model
TCP/IP uses a simplified four-layer model, contrasted with the seven-layer osi-model:
- Layer 4: Application (highest)
- Layer 3: Transport
- Layer 2: Internet
- Layer 1: Network interface (lowest)
OSI vs. TCP models
+--------------+-------------------+
| OSI LAYER | TCP/IP LAYER |
+--------------+-------------------+
| Application | |
+--------------+ |
| Presentation | Application |
+--------------+ |
| Session | |
+--------------+-------------------+
| Transport | Transport |
+--------------+-------------------+
| Network | Internet |
+--------------+-------------------+
| Data Link | |
+--------------+ Network Interface |
| Physical | |
+--------------+-------------------+
TCP header fields
- Time to Live (TTL) — How long a packet should live on the network before being discarded.
- Source port — A random (unused) port chosen by the sender.
- Destination port — The port on the receiving end, determined by the application being used.
- Source address — “From” IP address.
- Destination address — “To” IP address.
- Sequence number — A random number that identifies a given connection.
- Acknowledgement number — Starts at the sequence number and then increases by the number of bytes received in the previous packet (or 1 if the previous packet did not include a data segment). Used to ensure no data is lost and that packets are reassembled in the right order.
- Checksum — Integrity check.
- Flag(s) — How the packet should be handled (SYN, ACK, FIN, RST, etc.).
- Data — The payload.
Acknowledgement number semantics
The acknowledgement number contains the next sequence number that the sender expects to receive (so senders effectively determine the next sequence number). This is the current sequence number (for the other host) plus the number of bytes in the data segment of the packet being sent to that host.
- Packets with a zero-length data segment that start or continue a conversation (for example, SYN packets) get their sequence/acknowledgement number incremented by 1. This is called a ghost byte.
- The acknowledgement number for RST packets is always 0.
- The initial SYN packet that starts the three-way handshake should not have an acknowledgement number.
TCP header flags
| Flag | Purpose |
|---|---|
| URG | Process the current packet immediately. Directs the receiving system to examine the “urgent pointer” field. |
| ACK | Acknowledgement. Directs the receiving system to examine the “acknowledgement number” field. |
| PSH | Push. Elevate the priority of the packet’s data, but does not otherwise change rules around packet processing. |
| RST | Reset. Terminates the connection forcefully. |
| SYN | Synchronize. Used during the initial three-way handshake to set a shared (starting) sequence number. |
| FIN | Finish. Indicates that the connection may be dropped gracefully. |
TCP window size
The TCP Window is the maximum number of bytes that the sending system expects to receive from a request (it represents the current buffer size for that connection on that system). This is a 16-bit field, such that the maximum (unscaled) window size is 65,535 bytes.
TCP options
TCP options are negotiated during the initial handshake: the initiating host proposes options in the SYN packet, and the receiving host replies with what it supports in the SYN/ACK. Each system sets its own window scale and MSS values, but these must be accepted by both hosts to be used.
- Window Scale — A multiplier for the window size as a power of two. A Window Scale of 7 is a multiplier of 2⁷ = 128. Window scales can go up to 14, allowing (once multiplied with the maximum window size) up to 1 GiB of data to be transmitted before an ACK is required. Typically set to 2 for web servers, or 0 for systems that wish to allow the option but don’t support large buffers themselves. See RFC 7323.
- Maximum Segment Size (MSS) — The maximum data segment size that a system can receive. This differs from the window size, which is the amount of data a system expects before it gets an ACK (its buffer for this connection).
- Selective Acknowledgement (SACK) — Allows packets to be acknowledged as they are received, rather than at the end of a window. SACK enables dropped packets to be retransmitted sooner and prevents retransmission of packets that were properly received after a dropped packet. However, SACK requires the transmitting host to track sent packets in memory, so it is typically not set on resource-constrained systems (IoT, etc.).
- No-Op (NOP) — A “blank” value (01) used to pad out the options field, since header size must be a power of two bytes but each option must fall on a byte boundary. NOP usage is highly implementation-dependent. Middle-boxes (firewalls, routers, etc.) can also use NOPs to strip options.
If SACK is used, acknowledged packet numbers are placed in the options block.
Differences in how TCP options are responded to for incoming SYN packets, or ordered for outgoing SYN/ACK packets, are important for fingerprinting operating systems and TCP stacks.
The initial round trip time (IRTT)
The initial round trip time (IRTT) is the time from the initial SYN packet in the TCP handshake to the final ACK packet in the three-way handshake. Most TCP implementations initially wait up to 0.5 seconds before retransmitting, but dynamically adjust to 3×–4× the IRTT after the initial handshake. wireshark reports the IRTT value in the final ACK packet of the three-way handshake.