1. Figure 3-23: Transmission Control Protocol (TCP) (Study Figure)
TCP Messages are TCP Segments
Flags field has several one-bit flags: ACK, SYN, FIN, RST, etc.
Header
Length
(4 bits)
Reserved
(6 bits)
Flag Fields
(6 bits)
Window Size
(16 bits)

2. Figure 3-23: Transmission Control Protocol (TCP) (Study Figure)
Reliable
Receiving process sends ACK to sending process if segment is correctly received
ACK bit is set (1) in acknowledgement segments
If sending process does not get ACK, resends the segment PC
Transport Process
Webserver
Transport Process
TCP Segment
TCP Segment (ACK)

3. Figure 3-23: Transmission Control Protocol (TCP) (Study Figure)
Connections: Opens and Closes
Formal open and close
Three-way open: SYN, SYN/ACK, ACK (Figure 3-25)
Normal four-way close: FIN, ACK, FIN, ACK (Figure 3-25)
Abrupt close: RST (Figure 3-26)

4. Figure 3-25: Communication During a TCP SessionPC
Transport Process
Webserver
Transport Process
1. SYN (Open)
Open
(3)
2. SYN, ACK (1) (Acknowledgement of 1)
3. ACK (2)
3-Way Open

5. Figure 3-25: Communication During a TCP SessionPC
Transport Process
Webserver
Transport Process
1. SYN (Open)
Open
(3)
2. SYN, ACK (1) (Acknowledgement of 1)
3. ACK (2)
4. Data = HTTP Request
Carry
HTTP
Req &
Resp
(4)
5. ACK (4)
6. Data = HTTP Response
7. ACK (6)

6. Figure 3-25: Communication During a TCP SessionPC
Transport Process
Webserver
Transport Process
8. Data = HTTP Request (Error)
Carry
HTTP
Req &
Resp
(4)
9. Data = HTTP Request (No ACK so Retransmit)
10. ACK (9)
11. Data = HTTP Response
12. ACK (11)
Error Handling

7. Figure 3-25: Communication During a TCP SessionPC
Transport Process
Webserver
Transport Process
Normal Four-Way Close
13. FIN (Close)
Close
(4)
14. ACK (13)
15. FIN
16. ACK (15)
Note: An ACK may be combined with the next message if the next message
is sent quickly enough

8. Figure 3-25: Communication During a TCP SessionPC
Transport Process
Webserver
Transport Process
Abrupt Close
RST
Close
(1)
Either side can send
A Reset (RST) Segment
At Any Time
Ends the Session Immediately

9. Figure 3-26: SYN/ACK Probing Attack Using Reset (RST)
1. Probe
2. No Connection: Makes No Sense!
SYN/ACK Segment
IP Hdr
RST Segment
Attacker
is Live!
Victim Crashes
4. Source IP Addr=
3. Go Away!

10. Figure 3-23: Transmission Control Protocol (TCP) (Study Figure)
Sequence and Acknowledgement Number
Sequence numbers identify segment’s place in the sequence
Acknowledgement number identifies which segment is being acknowledged
Source Port Number (16 bits)
Destination Port Number (16 bits)
Sequence Number (32 bits)
Acknowledgment Number (32 bits)

11. Figure 3-23: Transmission Control Protocol (TCP) (Study Figure)
Port Number
Port numbers identify applications
Well-known ports (0-1023) used by applications that run as root (Figure 3-27)
HTTP=80, Telnet=23, FTP=21 for supervision, 20 for data transfer, SMTP=25
Source Port Number (16 bits)
Destination Port Number (16 bits)

12. Figure 3-23: Transmission Control Protocol (TCP) (Study Figure)
Port Number
Registered ports ( ) for any application
Ephemeral/dynamic/private ports ( ) used by client (16,384 possible)
Not all operating systems uses these port ranges, although all use well-known ports

13. Figure 3-23: Transmission Control Protocol (TCP) (Study Figure)
:80
Port Number
Socket format is IP address: Port, for instance, :80
Designates a specific program on a specific machine
Port spoofing (Figure 3-28)
Incorrect application uses a well-known port
Especially 80, which is often allowed through firewalls