er. The interpretation of this byte stream is up to the applications on each end of the connection.
This treatment of the byte stream by TCP is similar to the treatment of a file by the Unix operating system. The Unix kernel does no interpretation whatsoever of the bytes that an application reads or write that is up to the applications. There is no distinction to the Unix kernel between a binary file or a file containing lines of text.
Each TCP segment contains the source and destination port number to identify the sending and receiving application. These two values, along with the source and destination IP addresses in the IP header, uniquely identify each connection.
The combination of an IP address and a port number is sometimes called a socket (a term used in the Berkeley derived programming interface). It is the socket pair (the 4-tuple consisting of the client IP address, client port number, server IP address, and server port number) that specifies the two end points that uniquely identifies each TCP connection in an internet.
The sequence number identifies the byte in the stream of data from the sending TCP to the receiving TCP that the first byte of data in this segment represents. If we consider the stream of bytes flowing in one direction between two applications, TCP numbers each byte with a sequence number.
Since every byte that is exchanged is numbered, the acknowledgment number contains the next sequence number that the sender of the acknowledgment expects to receive. This is therefore the sequence number plus 1 of the last successfully received byte of data.
TCP provides a full-duplex service to the application layer. This means that data can be flowing in each direction, independent of the other direction.
There are six flag bits in the TCP header.
- URG: the urgent pointer is valid
- ACK: the acknowledgment number is valid
- PSH: the receiver should pass this data to the application as soon as possible
- RST: reset the connection
- SYN: synchronize sequence numbers to initiate a connection
- FIN: the sender is finished sending data
The data portion of the segment is optional. On connection and termination segments are exchanged without data.
Chapter 18: TCP Connection Establishment and Termination
TCP is a connection-oriented protocol. Before either end can send data to the other, a connection must be established between them.
tcpdump abbreviates the flags S (SYN), F (FIN), R (RST), P (PSH) and . (no flags).
1415531521:1415531521 (0) means the sequence number of the packet was 1415531521 and the number of data bytes in the segment was 0.
win shows the window size.
<mss 1024> shows the maximum segment size (MSS) option specified by the sender. The sender does not want to receive TCP segments larger than this value.
To establish a TCP connection:
- The requesting end (normally called the client) sends a SYN segment specifying the port number of the server that the client wants to connect to, and the client's initial sequence number (ISN, 1415531521 in this example). This is segment 1.
- The server responds with its own SYN segment containing the server's initial sequence number (segment 2). The server also acknowledges the client's SYN by ACKing the client's ISN plus one. A SYN consumes one sequence number.
- The client must acknowledge this SYN from the server by ACKing the server's ISN plus one (segment 3).
Three segments complete the connection establishment. This is often called the three-way handshake.
It takes four segments to terminate a connection. Since a TCP connection is full-duplex (that is, data can be flowing in each direction independently of the other direction), each direction must be shut down independently. Either end can send a FIN when it is done sending data.
The receipt of a FIN only means there will be no more data flowing in that direction. A TCP can still send data after receiving a FIN. While it's possible for an application to take advantage of this half-close, in practice few TCP applications use it.
Most Berkeley-derived systems set a time limit of 75 seconds on the establishm