TCP three-way handshake/four-way handshake explanation, tcp three-way handshake explanation

TCP three-way handshake/four-way handshake explanation, tcp three-way handshake explanation
1. TCP/IP protocol family

TCP/IP is a protocol family, which is usually developed at different levels. Each layer is responsible for different communication functions. It includes the following four levels:

 

1. The link layer, also known as the data link layer or network interface layer, usually includes the device driver in the operating system and the network interface card corresponding to the computer. They work together with the physical interface details of the cable (or any other transmission medium.

2. The network layer, also known as the Internet layer, Processes Group Activities in the network, such as group routing. Network Layer Protocols include IP protocol (Internet Protocol), ICMP protocol (Internet Control Packet protocol), and IGMP protocol (Internet Group Management Protocol ).

3. the transport layer provides end-to-end communication for applications on two hosts. In the TCP/IP protocol family, there are two different transmission protocols: TCP (Transmission Control Protocol) and UDP (User Datagram Protocol ). TCP provides high-Reliability Data Communication for two hosts. His work includes dividing the data that an application has handed over to it into small pieces and handing it over to the network layer below, confirming the group received, and setting the timeout clock for sending the final confirmation group. Because the transport layer provides high-reliability end-to-end communication, the application layer can ignore all these details. On the other hand, UDP provides a very simple service for the application layer. It only sends a group called a datagram from one host to another, but it does not guarantee that the datagram can reach the other end. Any required reliability must be provided by the application layer.

4. the application layer is responsible for handling specific application details. Including Telnet (Remote logon), FTP (file transfer protocol), SMTP (Simple Mail Transfer Protocol), and SNMP (Simple Network Management Protocol.

Shows the packets captured by wireshark and the corresponding protocol layer:

 

 

1. Frame: data Frame overview of the Physical Layer

2. Ethernet II: Ethernet frame header information at the data link layer

3. Internet Protocol Version 4: Internet layer IP packet header information

4. Transmission Control Protocol: information about the data segment header of the transport layer, which is TCP

5. Hypertext Transfer Protocol: information of the application layer. This is the HTTP Protocol.

Ii. TCP protocol

TCP is a connection-oriented and reliable byte stream-based transport layer communication protocol. TCP packs user data into a packet segment. After sending the packet, it starts a timer to confirm the data received by the other end, resorts the out-of-order data, and discards repeated data.

TCP has the following features:

1. TCP is a connection-oriented transport layer protocol

2. Each TCP connection can have only two endpoints, and each TCP connection can only be point-to-point.

3. TCP provides reliable delivery services

4. TCP provides full-duplex communication. Data is transmitted independently in two directions. Therefore, each end of the connection must maintain the serial number transmitted in each direction.

5. byte stream oriented. Meaning of byte stream: although the application interacts with TCP as a data block, the data transmitted by TCP to the application is only a series of unstructured byte streams.

Shows the TCP packet header:

 

1. Source Port Number: Port Number of the Data initiator, 16bit

2. Destination Port Number: the port number of the data receiver, 16bit

3. Serial number: 32-bit serial number, used by the sender

4. Validation serial number: The 32bit validation number, which is the serial number of the next packet segment that the recipient expects to receive. Therefore, the validation serial number should be the byte serial number that has been successfully received last time plus 1.

5. Header Length: the number of 32-bit characters in the header, which can represent the header of 15*32-bit = 60 bytes. Generally, the header length is 20 bytes.

6. Reserved: 6 bits, all 0

7. URG: When URG = 1, it indicates that there is urgent data in the packet segment and it should be transmitted as soon as possible.

8. confirm that the bitack: ACK = 1 table is a confirmed TCP packet, and the value 0 is not a confirmation packet.

9. Push bit PSH: When the sending side PSH is 1, the receiving end is delivered to the application process as soon as possible.

10. Reset bit (RST): When RST is set to 1, it indicates a serious error occurred in the TCP connection. The connection must be released and then established again.

11. synchronous bit SYN: used to synchronize serial numbers when a connection is established. SYN = 1, ACK = 0 indicates a connection request packet segment. SYN = 1, ACK = 1 indicates that you agree to establish a connection.

12. When the bit FIN: FIN = 1 is terminated, it indicates that the data of the sender of the packet segment has been sent and the transmission connection must be released.

13. Window: used to control the volume of data sent by the recipient, and the maximum number of sending windows that have been determined for notification issuance.

14. test: The field test scope includes the header and data. It is calculated and stored by the initiator and verified by the receiver.

15. Emergency pointer: The emergency pointer is valid only when URG = 1, which indicates the number of bytes of emergency data in this section.

16. Option: Variable Length, up to 40 bytes

Shows each field in the TCP packet captured by wireshark:

 

 

 

 

Iii. TCP three-way handshake

When TCP establishes a connection, there is a three-way handshake process, as shown in, wireshark intercepts the three data packets of the three-way handshake. The fourth packet is http, which indicates that http uses TCP to establish a connection.

 

 

Next we will analyze the three-way handshake process step by step:

The first handshake: the client sends a connection request packet to the server. The flag SYN (synchronous serial number) is set to 1 and the serial number is X = 0.

 

 

The second handshake: the server receives the message sent from the client. SYN = 1 indicates that the client needs to be online. Send a TCP packet with both SYN and ACK set to 1 to the client, set the initial serial Number Y = 0, and set Acknowledgement Number to add 1 to the customer's serial Number, that is, X + 1 = 0 + 1 = 1, for example:

The third handshake: After receiving the packet sent from the server, the client checks whether the Acknowledgement Number is correct, that is, the Number sent for the first time is plus 1 (X + 1 = 1 ). And whether the flag ACK is 1. If yes, the server sends a confirmation packet again. The ACK flag is 1 and the SYN flag is 0. Acknowledgement Number = Y + 1 = 0 + 1 = 1, and the sending sequence Number is X + 1 = 1. After receiving the message, the client confirms that the serial number and ACK = 1 are connected successfully and data can be transferred.

 

4. Four TCP Waves

When the TCP connection is disconnected, there will be four waves, as shown in, wireshark intercepts the four packets that waved four times.

 

 

Next we will analyze the four waves step by step:

The first wave: the client sends a TCP packet to the server to disable data transmission from the client to the server. Set the flag FIN and ACK to 1, the serial number is X = 1, and the serial number is Z = 1.

 

After receiving the FIN, the server sends back an ACK (flag ACK = 1) and confirms that the serial number is the received serial number plus 1, that is, X = X + 1 = 2. The serial number is the received confirmation serial number = Z.

 

The server closes the connection with the client and sends a FIN. Set the flag FIN and ACK to 1, and the serial number is Y = 1. confirm that the serial number is X = 2.

After receiving the FIN sent by the server, the client sends back ACK for confirmation (flag ACK = 1). The confirmation serial number is 1 for the received serial number, that is, Y + 1 = 2. The serial number is the received confirmation serial number X = 2.