Status of TCP (SYN, FIN, ACK, PSH, RST, URG)

In the TCP layer, there is a flags field that has the following identifiers: SYN, FIN, ACK, PSH, RST, URG.

The five fields that are useful for our daily analysis are the previous one.

What they mean is:

SYN indicates a connection is established,

Fin means close the connection,

ACK indicates a response,

PSH indicates data data transfer,

The RST indicates a connection reset.

Where ACK is likely to be used in conjunction with Syn,fin, such as SYN and ACK may be at 1, it represents the response after the connection is established.

If it is just a single SYN, it represents just the connection being established.

A few handshakes of TCP are represented by such an ACK.

However, SYN and fin are not 1 at the same time, because the former represents a connection, and the latter represents a disconnection.

The RST is typically 1 after fin, indicating a connection reset.

Generally, when a fin or RST packet is present, we think the client is disconnected from the server side, and when the SYN and Syn+ack packets are present, we think that the client has established a connection with the server.

PSH is 1, typically only in packets where the data content is not 0, meaning that PSH is 1 means that there is a real TCP packet content being passed.

TCP connection establishment and connection shutdown are done through a request-response pattern.

Concept Supplement-tcp three-time handshake:

TCP (transmission Control Protocol) transmission protocol

TCP is the host-to-host layer of the Transmission Control Protocol, providing a reliable connection service, using three-time handshake confirmation to establish a connection:

The bit code is the TCP flag bit, there are 6 kinds of marking: SYN (synchronous set up) ACK (acknowledgement acknowledgment) PSH (push transfer) FIN (finish end) RST (reset reset) URG (Urgent emergency) Sequence number (sequential) Acknowledge number (confirmation)

First handshake: Host a send bit code for syn=1, randomly generate SEQ number=1234567 packet to the server, Host B by Syn=1 know, a requirements to establish online;

Second handshake: Host B receives the request to confirm the online information, send an ACK to a number= (host a seq+1), syn=1,ack=1, randomly generate seq=7654321 packets;

Third handshake: Host a after receiving check ACK number is correct, that is, the first sent Seq Number+1, and the bit code ACK is 1, if correct, host A will send an ACK number= (Host B seq+1), ack= 1, Host B is received after confirming the SEQ value and ack=1 The connection was established successfully.

To complete the three handshake, host A and Host B start transmitting data.

In the TCP/IP protocol, the TCP protocol provides a reliable connection service with a three-time handshake to establish a connection. First handshake: When a connection is established, the client sends a SYN packet (SYN=J) to the server and enters the Syn_send state, waits for the server to confirm; second handshake: The server receives the SYN packet, must confirm the customer's SYN (ACK=J+1), and also sends a SYN packet (syn= k), that is, the Syn+ack packet, when the server enters the SYN_RECV state;

Third handshake: The client receives the server's Syn+ack packet, sends the acknowledgment packet ack (ACK=K+1) to the server, the packet is sent, the client and the server enter the established state, and the handshake is completed three times. Three handshake is completed and the client and server begin to transfer data. From China Yunan Net (www.yunsec.net) Original: http://www.yunsec.net/a/school/wlcs/agreement/2012/0317/10262.html

Status of TCP (SYN, FIN, ACK, PSH, RST, URG)