P
r
o
t
o
c
o
lL
e
v
e
l
s
H
T
T
P
:P
a
c
k
e
t
T
C
P
H
e
a
d
e
r
D
a
t
a
I
P
H
e
a
d
e
r
D
a
t
a
E
t
h
e
r
n
e
tH
e
a
d
e
r D
a
t
a
T
C
P
/
I
P
P
r
o
t
o
c
o
l
s
H
T
T
P
F
T
P
P
O
P
S
N
M
P
D
N
S
P
I
N
G
e
l
n
e
t D
S
M
T
P T
H
C
P
T
C
P
U
D
P
I
P
M
A
C
L
a
y
e
r
(
E
t
h
e
r
n
e
t
)
I
C
M
P
A
R
P
Destination
Reassembly Required
router
IP packet fragments
Fragments Created
router
IP packet
source
TCP
• Connection Oriented
– state
• Stream Oriented
– Sequence number
• Full Duplex
• Reliable
– acknowledgment
TCP Commands
•
•
•
•
•
•
Syn – synchronize sequence numbers
Ack – acknowledgement
Fin – close connection
Push – send data immediately
Urgent – look at data out of sequence
Reset – reject connection
TCP Connection
• Passive Open
– Server opens known port and waits for client to
connect (no traffic on network)
• Active open
– Client opens any available port and connects to
server on known port (starts three way
handshake)
TCP Connection States
LISTEN
SYN-SENT
SYN-RCVD
ESTABLISHED
FIN-WAIT-1
FIN-WAIT-2
CLOSE-WAIT
LAST-ACK
Server waiting
Waiting for ack
Syn received
Connection established
Closing requested
Closing accepted
Server waiting for client to close
Server waiting for last ack
CLOSED
Active open/syn
Passive open
Syn/ syn+ack
SYN-SENT
LISTEN
Syn+ack/ack
SYN-RCVD
ack
ESTABLISHED
Fin/ack
Close/fin
FIN-WAIT-1
Ack/
CLOSE-WAIT
FIN-WAIT-2
Fin/ack
Close/fin
TIME-WAIT
timeout
LAST-ACK
ack
TCP Sliding Window
• Sequence No. - number of first byte in the
segment
• Acknowledgement – number of next byte
expected
• Sliding Window – number of bytes that can
be transmitted without an acknowledgement
Sender
K S U
G O L D E N
Sliding Window
Receiver
Sliding Window
F L A S H E S
Sent, not yet acked
K S U
G O L D E N
Sliding Window
K S U
F L A S H E S
Ready to send
Sent, not yet acked
K S U
G O L D E N
Sent and
F L A S H E S
Sliding Window
Ready to send
ACKed
K S U
D E N
F L A
K S U
G O L D E N
F L A S H E S
Sent and
Sliding Window
ACKed
K S U
G O L D E N
F L A
Client
Server
Seq 7280
Client sends syn to open
connection
Server
Client
Syn, Ack
Seq 5965
Ack 7281
Server sends Ack and Syn
Server
Client
Syn, Ack
Cient sends Ack, connection is
established
Seq 7281
Ack 5966
Server
Client
Syn, Ack
Client requests Web Page
Seq 7281
Ack 5966
Server
Client
Syn, Ack
Server sends first part of Web
Page
Seq 5966
ack 7532
Server
Client
Syn, Ack
Server sends remainder of page
Seq 5966
ack 7531
Seq 7426
ack 7531
Server
Client
Syn, Ack
Client sends ack
Seq 7531
ack 8886
Server
Client
Syn, Ack
Server starts closing of
connection
Seq 8886
ack 7531
Server
Client
Syn, Ack
Client acks closing of server’s
side of connection
Seq 7531
ack 9203
Server
Client
Syn, Ack
Seq 7531
ack 9203
Client requests closing of its
side of connection
Server
Client
Syn, Ack
Seq 9203
ack 7532
Server sends Ack,
connection closed
A
R
P
A
R
P
R
e
s
p
o
n
s
e
(
u
n
i
c
a
s
t
)
Ia
m
1
3
1
.
1
2
3
.
8
.
8
,
H
A
=
0
0
C
0
4
F
A
B
D
A
0
C
http://www.rhyshaden.com/arp.htm
D
H
C
P
D
H
C
P
R
e
s
p
o
n
s
e
(
U
n
i
c
a
s
t
)
I
P
1
3
1
.
1
2
3
.
8
.
1
7
3
M
a
s
k
:2
5
5
.
2
5
5
.
2
5
5
.
0
R
o
u
t
e
r
:1
3
1
.
1
2
3
.
8
.
1
0
D
N
S
:1
3
1
.
1
2
3
.
1
.
1
1
3
1
.
1
2
3
.
4
.
2
3
D
H
C
P
C
l
i
e
n
t
D
H
C
P
S
e
r
v
e
r
0
16
8
TYPE
CODE
IDENTIFIER
31
CHECKSUM
SEQUENCE NUMBER
OPTIONAL DATA
ICMP Echo message
ftp client
ftp server
131.123.8.111
131.123.250.211
2353
2349
21
20
TCP Segments
Proto Local Address
Foreign Address
TCP 131.123.8.111:2349 131.123.250.211:21
TCP 131.123.8.111:2353
131.123.250.211:20