TCP ( Transmission Control Protocol )

• Basic Data Transfer

The TCP is able to transfer a continuous stream of octets in each direction between its users by packaging some number of octets into segments for transmission through the internet system. In general, the TCPs decide when to block and forward data at their own convenience.

Sometimes users need to be sure that all the data they have submitted to the TCP has been transmitted. For this purpose a push function is defined. To assure that data submitted to a TCP is actually transmitted the sending user indicates that it should be pushed through to the receiving user. A push causes the TCPs to promptly forward and deliver data up to that point to the receiver. The exact push point might not be visible to the receiving user and the push function does not supply a record boundary marker.


• TCP Reliability

TCP reliability depends upon the existence of a bound on the lifetime of a segment: the "Maximum Segment Lifetime" or MSL. An MSL is generally required by any reliable transport protocol, since every sequence number field must be finite, and therefore any sequence number may eventually be reused. In the Internet protocol suite, the MSL bound is enforced by an IP-layer mechanism, the "Time-to-Live" or TTL field.
Duplication of sequence numbers might happen in either of two ways:

• Sequence number wrap-around on the current connection
  A TCP sequence number contains 32 bits. At a high enough transfer rate, the 32-bit sequence space may be "wrapped" (cycled) within the time that a segment is delayed in queues.



• Earlier incarnation of the connection
  Suppose that a connection terminates, either by a proper close sequence or due to a host crash, and the same connection (i.e., using the same pair of sockets) is immediately reopened. A delayed segment from the terminated connection could fall within the current window for the new incarnation and be accepted as valid.


• Flow Control

TCP provides a means for the receiver to govern the amount of data sent by the sender. This is achieved by returning a "window" with every ACK indicating a range of acceptable sequence numbers beyond the last segment successfully received. The window indicates an allowed number of octets that the sender may transmit before receiving further permission.


• Multiplexing

To allow for many processes within a single Host to use TCP communication facilities simultaneously, the TCP provides a set of addresses or ports within each host. Concatenated with the network and host addresses from the internet communication layer, this forms a socket. A pair of sockets uniquely identifies each connection. That is, a socket may be simultaneously used in multiple connections.
The binding of ports to processes is handled independently by each Host. However, it proves useful to attach frequently used processes (e.g., a "logger" or timesharing service) to fixed sockets which are made known to the public. These services can then be accessed through the known addresses. Establishing and learning the port addresses of other processes may involve more dynamic mechanisms.


• Connections

The reliability and flow control mechanisms described above require that TCPs initialize and maintain certain status information for each data stream. The combination of this information, including sockets, sequence numbers, and window sizes, is called a connection. Each connection is uniquely specified by a pair of sockets identifying its two sides.
When two processes wish to communicate, their TCP's must first establish a connection (initialize the status information on each side). When their communication is complete, the connection is terminated or closed to free the resources for other uses.
Since connections must be established between unreliable hosts and over the unreliable internet communication system, a handshake mechanism with clock-based sequence numbers is used to avoid erroneous initialization of connections.


• Precedence and Security

The users of TCP may indicate the security and precedence of their communication. Provision is made for default values to be used when these features are not needed.

• Source Port

16 bits. Source port number.


• Destination Port

16 bits. Destination port number.


• Sequence Number

32 bits. The sequence number of the first data octet in this segment (except when SYN is present). If SYN is present, the sequence number is the initial sequence number (ISN) and the first data octet is ISN+1.


• Acknowledgment Number

32 bits. If the ACK control bit is set, this field contains the value of the next sequence number which the sender of the segment is expecting to receive. Once a connection is established, this value is always sent.


• Data Offset

4 bits. The number of 32-bit words in the TCP header. This indicates where the data begins. The length of the TCP header is always a multiple of 32 bits.


• Reserved

6 bits. Reserved for future use. Must be cleared to zero.


• Control

6 bits. The control bits may be (from right to left):


U (URG)	Urgent pointer field significant.
A (ACK)	Acknowledgment field significant.
P (PSH)	Push function.
R (RST)	Reset the connection.
S (SYN)	Synchronize sequence numbers.
F (FIN)	No more data from sender.



• Window

16 bits. It specifies the size of the sender's receive window, that is, the buffer space available in octets for incoming data.


• Checksum

16 bits. The checksum field is the 16 bit one¡¯s complement of the one¡¯s complement sum of all 16-bit words in the header and text. If a segment contains an odd number of header and text octets to be checksummed, the last octet is padded on the right with zeros to form a 16-bit word for checksum purposes. The pad is not transmitted as part of the segment. While computing the checksum, the checksum field itself is replaced with zeros.


• Urgent Pointer

16 bits. This field communicates the current value of the urgent pointer as a positive offset from the sequence number in this segment. The urgent pointer points to the sequence number of the octet following the urgent data. This field can only be interpreted in segments for which the URG control bit has been set.


• Options

Options may be transmitted at the end of the TCP header and always have a length which is a multiple of 8 bits. All options are included in the checksum. An option may begin on any octet boundary.
There are two possible formats for an option:

• A single octet of option type.


• An octet of option type, an octet of option length, and the actual option data octets.

The option length includes the option type and option length, as well as the option data octets. The list of options may be shorter than that designated by the data offset field because the contents of the header beyond the End-of-Option option must be header padding i.e., zero.


• Padding

Variable length. The TCP header padding is used to ensure that the TCP header ends and data begins on a 32 bit boundary. The padding is composed of zeros. The TCP header must be padded with zeros to make the header length a multiple of 32 bits.


Kind	Length	Description
0	1	End of option list.
1	1	No operation.
2	4	Maximum Segment Size.
3	3	Window scale factor.
4	2	SACK permitted.
5	Variable.	SACK.
6	6	Echo.
7	6	Echo reply.
8	10	Timestamp.
9	2	Partial Order Connection Permitted.
10	3	Partial Order Service Profile.
11	6	CC, Connection Count.
12	6	CC.NEW
13	6	CC.ECHO
14	3	TCP Alternate Checksum Request.
15	Variable.	TCP Alternate Checksum Data.
16		Skeeter.
17		Bubba.
18	3	Trailer Checksum Option.
19	18	MD5 signature.
20		SCPS Capabilities.
21		Selective Negative Acknowledgements.
22		Record Boundaries.
23		Corruption experienced.
24		SNAP.
25
26		TCP Compression Filter.



• Data

Variable length. TCP data or higher layer protocol.

                              +---------+ ---------      active OPEN  

                              |  CLOSED |                -----------  

                              +---------+<---------      create TCB  

                                |     ^                   snd SYN    

                   passive OPEN |     |   CLOSE                      

                   ------------ |     | ----------                   

                    create TCB  |     | delete TCB                   

                                V     |                              

                              +---------+            CLOSE    |       

                              |  LISTEN |          ---------- |     |  

                              +---------+          delete TCB |     |  

                   rcv SYN      |     |     SEND              |     |  

                  -----------   |     |    -------            |     V  

 +---------+      snd SYN,ACK  /          snd SYN          +---------+

 |         |<-----------------           ------------------>|         |

 |   SYN   |                    rcv SYN                     |   SYN   |

 |   RCVD  |<-----------------------------------------------|   SENT  |

 |         |                    snd ACK                     |         |

 |         |------------------           -------------------|         |

 +---------+   rcv ACK of SYN         /  rcv SYN,ACK       +---------+

   |           --------------   |     |   -----------                  

   |                  x         |     |     snd ACK                    

   |                            V     V                                

   |  CLOSE                   +---------+                              

   | -------                  |  ESTAB  |                              

   | snd FIN                  +---------+                              

   |                   CLOSE    |     |    rcv FIN                     

   V                  -------   |     |    -------                     

 +---------+          snd FIN  /          snd ACK          +---------+

 |  FIN    |<-----------------           ------------------>|  CLOSE  |

 | WAIT-1  |------------------                              |   WAIT  |

 +---------+          rcv FIN                              +---------+

   | rcv ACK of FIN   -------   |                            CLOSE  |  

   | --------------   snd ACK   |                           ------- |  

   V        x                   V                           snd FIN V  

 +---------+                  +---------+                   +---------+

 |FINWAIT-2|                  | CLOSING |                   | LAST-ACK|

 +---------+                  +---------+                   +---------+

   |                rcv ACK of FIN |                 rcv ACK of FIN |  

   |  rcv FIN       -------------- |    Timeout=2MSL -------------- |  

   |  -------              x       V    ------------        x       V  

     snd ACK                 +---------+delete TCB         +---------+

     ------------------------>|TIME WAIT|------------------>| CLOSED  |

                              +---------+                   +---------+

• Determining that an acknowledgment refers to some sequence number sent but not yet acknowledged.


• Determining that all sequence numbers occupied by a segment have been acknowledged (e.g., to remove the segment from a retransmission queue).


• Determining that an incoming segment contains sequence numbers which are expected (i.e., that the segment "overlaps" the receive window).

SND.UNA = oldest unacknowledged sequence number
SND.NXT = next sequence number to be sent
SEG.ACK = acknowledgment from the receiving TCP (next sequence number expected by the receiving TCP)
SEG.SEQ = first sequence number of a segment
SEG.LEN = the number of octets occupied by the data in the segment (counting SYN and FIN)
SEG.SEQ+SEG.LEN-1 = last sequence number of a segment

SND.UNA < SEG.ACK =< SND.NXT

RCV.NXT = next sequence number expected on an incoming segments, and is the left or lower edge of the receive window
RCV.NXT+RCV.WND-1 = last sequence number expected on an incoming segment, and is the right or upper edge of the receive window
SEG.SEQ = first sequence number occupied by the incoming segment
SEG.SEQ+SEG.LEN-1 = last sequence number occupied by the incoming segment

RCV.NXT =< SEG.SEQ < RCV.NXT+RCV.WND

RCV.NXT =< SEG.SEQ+SEG.LEN-1 < RCV.NXT+RCV.WND

          Segment Receive  Test

          Length  Window

          ------- -------  -------------------------------------------

             0       0     SEG.SEQ = RCV.NXT

             0      >0     RCV.NXT =< SEG.SEQ < RCV.NXT+RCV.WND

            >0       0     not acceptable

            >0      >0     RCV.NXT =< SEG.SEQ < RCV.NXT+RCV.WND

                        or RCV.NXT =< SEG.SEQ+SEG.LEN-1 < RCV.NXT+RCV.WND

• The user initiates by telling the TCP to CLOSE the connection


• The remote TCP initiates by sending a FIN control signal


• Both users CLOSE simultaneously



Case 1: Local user initiates the close
In this case, a FIN segment can be constructed and placed on the outgoing segment queue. No further SENDs from the user will be accepted by the TCP, and it enters the FIN-WAIT-1 state. RECEIVEs are allowed in this state. All segments preceding and including FIN will be retransmitted until acknowledged. When the other TCP has both acknowledged the FIN and sent a FIN of its own, the first TCP can ACK this FIN. Note that a TCP receiving a FIN will ACK but not send its own FIN until its user has CLOSED the connection also.

Case 2: TCP receives a FIN from the network
If an unsolicited FIN arrives from the network, the receiving TCP can ACK it and tell the user that the connection is closing. The user will respond with a CLOSE, upon which the TCP can send a FIN to the other TCP after sending any remaining data. The TCP then waits until its own FIN is acknowledged whereupon it deletes the connection. If an ACK is not forthcoming, after the user timeout the connection is aborted and the user is told.

Case 3: both users close simultaneously
A simultaneous CLOSE by users at both ends of a connection causes FIN segments to be exchanged. When all segments preceding the FINs have been processed and acknowledged, each TCP can ACK the FIN it has received. Both will, upon receiving these ACKs, delete the connection.

• Open

To establish a connection, takes several parameters:
Active/passive
Foreign socket
Local port number
Timeout value (optional)
And lots of other options
Returns a local connection name, which is used to reference this particular connection in all other functions.


• Send

Causes data in a referenced user buffer to be sent over the connection. Can optionally set the URGENT flag or the PUSH flag.


• Receive

Copies incoming TCP data to a user buffer.


• Close

Closes the connection; causes a push of all remaining data and a TCP segment with FIN flag set.


• Status

Is an implementation-dependent call that could return information such as:
Local and foreign socket
Send and receive window sizes
Connection state
Local connection name


• Abort

Causes all pending Send and Receive operations to be aborted, and a RESET to be sent to the foreign TCP.

Example 1: Send Sequence Space



               1         2          3          4      

          ----------|----------|----------|---------- 

                 SND.UNA    SND.NXT    SND.UNA        

                                      +SND.WND       



          1 - Old sequence numbers which have been acknowledged.

          2 - Sequence numbers of unacknowledged data.

          3 - Sequence numbers allowed for new data transmission.

          4 - Future sequence numbers which are not yet allowed.

Example 2: Receive Sequence Space



            1          2          3      

          ----------|----------|---------- 

                 RCV.NXT    RCV.NXT        

                           +RCV.WND



          1 - Old sequence numbers which have been acknowledged.  

          2 - Sequence numbers allowed for new reception.         

          3 - Future sequence numbers which are not yet allowed.

Example 3: Basic 3-Way Handshake for Connection Synchronization



The three-way handshake reduces the possibility of false connections. It is the 

implementation of a trade-off between memory and messages to provide information for 

this checking.



              TCP A                                                TCP B

          1.  CLOSED                                               LISTEN

          2.  SYN-SENT    -->                --> SYN-RECEIVED

          3.  ESTABLISHED <--   <-- SYN-RECEIVED

          4.  ESTABLISHED -->        --> ESTABLISHED

          5.  ESTABLISHED -->  --> ESTABLISHED



Each line is numbered for reference purposes. Right arrows (-->) indicate departure 

of a TCP segment from TCP A to TCP B, or arrival of a segment at B from A. Left 

arrows (<--), indicate the reverse. Ellipsis (...) indicates a segment which is still 

in the network (delayed). An "XXX" indicates a segment which is lost or rejected. 

Comments appear in parentheses. TCP states represent the state AFTER the departure 

or arrival of the segment (whose contents are shown in the center of each line). 

Segment contents are shown in abbreviated form, with sequence number, control 

flags, and ACK field. Other fields such as window, addresses, lengths, and text 

have been left out in the interest of clarity.

Example 4: Simultaneous Connection Synchronization



Simultaneous initiation is only slightly more complex. Each TCP cycles from CLOSED 

to SYN-SENT to SYN-RECEIVED to ESTABLISHED.



              TCP A                                            TCP B

          1.  CLOSED                                           CLOSED

          2.  SYN-SENT     -->               ...

          3.  SYN-RECEIVED <--               <-- SYN-SENT

          4.               ...               --> SYN-RECEIVED

          5.  SYN-RECEIVED -->  ...

          6.  ESTABLISHED  <--  <-- SYN-RECEIVED

          7.               ...      --> ESTABLISHED

Example 5: Recovery from Old Duplicate SYN



As a simple example of recovery from old duplicates.



              TCP A                                                TCP B

          1.  CLOSED                                               LISTEN

          2.  SYN-SENT    -->                ...

          3.  (duplicate) ...                --> SYN-RECEIVED

          4.  SYN-SENT    <--   <-- SYN-RECEIVED

          5.  SYN-SENT    -->                --> LISTEN

          6.              ...                --> SYN-RECEIVED

          7.  SYN-SENT    <--   <-- SYN-RECEIVED

          8.  ESTABLISHED -->       --> ESTABLISHED

Example 6: Half-Open Connection Discovery



An established connection is said to be "half-open" if one of the TCPs has closed or 

aborted the connection at its end without the knowledge of the other, or if the two 

ends of the connection have become desynchronized owing to a crash that resulted 

in loss of memory. Such connections will automatically become reset if an attempt is 

made to send data in either direction. However, half-open connections are expected 

to be unusual, and the recovery procedure is mildly involved.



              TCP A                                           TCP B

          1.  (CRASH)                               (send 300,receive 100)

          2.  CLOSED                                           ESTABLISHED

          3.  SYN-SENT -->               --> (??)

          4.  (!!)     <--      <-- ESTABLISHED

          5.  SYN-SENT -->               --> (Abort!!)

          6.  SYN-SENT                                         CLOSED

          7.  SYN-SENT -->               -->

Example 7: Active Side Causes Half-Open Connection Discovery



An interesting alternative case occurs when TCP A crashes and TCP B tries to send 

data on what it thinks is a synchronized connection. The data arriving at TCP A 

from TCP B (line 2) is unacceptable because no such connection exists, so TCP A 

sends a RST. The RST is acceptable so TCP B processes it and aborts the connection.



                TCP A                                              TCP B

         1.  (CRASH)                                   (send 300,receive 100)

         2.  (??)    <--  <-- ESTABLISHED

         3.          -->                    --> (ABORT!!)

Example 8: Old Duplicate SYN Initiates a Reset on two Passive Sockets

The two TCPs A and B with passive connections wait for SYN.  An old duplicate 

arriving at TCP B (line 2) stirs B into action.  A SYN-ACK is returned (line 3) and 

causes TCP A to generate a RST (the ACK in line 3 is not acceptable).  TCP B 

accepts the reset and returns to its passive LISTEN state.



              TCP A                                         TCP B

          1.  LISTEN                                        LISTEN

          2.       ...                 -->  SYN-RECEIVED

          3.  (??) <--    <--  SYN-RECEIVED

          4.       -->               -->  (return to LISTEN!)

          5.  LISTEN                                        LISTEN

Example 9: Normal Close Sequence



              TCP A                                                TCP B

          1.  ESTABLISHED                                          ESTABLISHED

          2.  (Close)

                FIN-WAIT-1  -->   --> CLOSE-WAIT

          3.  FIN-WAIT-2  <--       <-- CLOSE-WAIT

          4.                                                       (Close)

                TIME-WAIT   <--   <-- LAST-ACK

          5.  TIME-WAIT   -->       --> CLOSED

          6.  (2 MSL)

                CLOSED

Simultaneous Close Sequence



              TCP A                                                TCP B

          1.  ESTABLISHED                                          ESTABLISHED

          2.  (Close)                                              (Close)

                FIN-WAIT-1  -->   ... FIN-WAIT-1

                            <--   <--

                            ...   -->

          3.  CLOSING     -->       ... CLOSING

                            <--       <--

                            ...       -->

          4.  TIME-WAIT                                            TIME-WAIT

                (2 MSL)                                              (2 MSL)

                CLOSED                                               CLOSED

■ Parent layer
■ Child layer

IP

TCP

SSH Kerberos DNS BOOTP HTTPS Timbuktu RTSP L2TP CSO NetBIOS CMIP Agent Retrospect RLOGIN RSH WINS MSN NFS RPC Lotus Notes FileMaker AOL CU-SeeMe HTTP Proxy CIFS SQL NCP SLP PPTP SIP MGCP SAP H.323 H.225 Citrix ICA GTP LDAP GroupWise BitTorrent HTTP FTP RTELNET TELNET SMTP WhoIs IMAP BGP IMAP3 Gopher Finger POP2 POP3 NNTP AFP Cayman IP ATalk X-Windows TNS TDS LDAPS IMAPS SCCP Gnutella iSCSI LPD ISO-8073 DCE Fibre Channel DAAP WP DNX POP3s MSRDP Shockwave MSSQL Goto MyPC Srvc_registry Other COPS