Transmission Control Protocol TCP

TCP checks to make sure that no packets are lost by giving each packet a sequence number, which is also used to make sure that the data are delivered to the entity at the other end in the correct order. The TCP module at the far end sends back an acknowledgement for packets which have been successfully received; a timer at the sending TCP will cause a timeout if an acknowledgement is not received within a reasonable round-trip time (or RTT), and the (presumably lost) data will then be re-transmitted. The TCP checks that no bytes are damaged by using a checksum; the checksum is calculated by the sender and posted into the package to be checked by the destination host. Note that if any of the bits transmitted across the network gets lost, the checksum will not match and the packet will be discarded.

For every connection, TCP uses the following flags to check the state of the transaction:

LISTEN - represents waiting for a connection request from any remote TCP and port. (Usually set by TCP servers)

SYN-SENT - represents waiting for the remote TCP to send back a TCP packet with the SYN and ACK flags set. (Usually set by TCP clients)

SYN-RECEIVED - represents waiting for the remote TCP to send back an acknowledgment after having sent back a connection acknowledgment to the remote TCP. (Usually set by TCP servers)

ESTABLISHED - represents that the port is ready to receive/send data from/to the remote TCP. (Set by TCP clients and servers)

TIME-WAIT - represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request. According to RFC 793 a connection can stay in TIME-WAIT for a maximum of four minutes.

Establishing a connection using the TCP/IP suite is done by a 3-way handshake: the client sends a SYN to the server, which replies in response with a SYN-ACK. The client sends then an acknowledgment also referred as SYN-ACK-ACK. As a result, a connection is opened between the two hosts and data can be transferred. Note that in TCP, data cannot be transferred without opening a "channel" for that transmission. That's why TCP/IP is also called a connection-oriented transmission.

Another concept related to TCP/IP is windowing. The TCP receive window size is the amount of received data (in bytes) that can be buffered during a connection. The sending host can send only that amount of data before it must wait for an acknowledgment and window update from the receiving host. When a receiver advertises the window size of 0, the sender stops sending data and starts the persist timer. The persist timer is used to protect TCP from the dead lock situation. The dead lock situation could be when the new window size update from the receiver is lost and the receiver has no more data to send while the sender is waiting for the new window size update. When the persist timer expires the TCP sender sends a small packet so that the receivers Acks the packet with the new window size and TCP can recover from such situations. Note that many routers and packet firewalls are rewriting the window-scaling factor during a transmission. That could become an issue if they are misconfigured.

The termination of a TCP transmission can be done with a maximum 4-way handshake. Typically only 2-way is needed. One side sends a FIN and the other one replies with an ACK.

Another key-concept is ports. Ports are required for managing multiple connections between two hosts (eg. If we search something on Google.com in parallel with two instances of Internet Explorer, we don't want the data to get mixed up). So to make every connection we make unique we use port numbers, a virtual "gate" to and from our computer to the host. There are many port numbers reserved to specific services (like port 80 for HTTP, 21 for FTP, 25 for SMTP, etc).

All this information can be seen by using a program that acts like a packet sniffer. You can "listen" for packets coming to your computer and analyse it. Another good way to check the state of your connections is by using netstat (in Windows go to Start Menu > Run > Type command or cmd > netstat.exe).

Here is an example:

Microsoft Windows 2000 [Version 5.00.2195]

(C) Copyright 1985-2000 Microsoft Corp.

C:\>netstat

Active Connections

Proto Local Address Foreign Address State

TCP localhost:1051 cs35.msg.dcn.yahoo.com:5050 ESTABLISHED

TCP localhost:1064 sip22.voice.re2.yahoo.com:5061 ESTABLISHED

TCP localhost:1126 fg-in-f91.google.com:http ESTABLISHED

TCP localhost:1167 mg-in-f19.google.com:http ESTABLISHED

TCP localhost:1169 mg-in-f19.google.com:http TIME_WAIT

TCP localhost:1282 London.UK.EU.undernet.org:6667 ESTABLISHED

Subscribe now via RSS feed and get all the new tutorials