Detailed Explanation of Core TCP/IP Terminology

Introduction

The TCP/IP protocol suite is the cornerstone of modern Internet communication. Understanding its core terminology is crucial for network engineers, developers, and anyone involved in Internet-related work. This article systematically introduces the key terms in TCP/IP, helping readers establish a complete knowledge system.

1. Basic Protocol Terms

1.1 TCP (Transmission Control Protocol)

TCP is a connection-oriented, reliable transport layer protocol. It ensures reliable data transmission through mechanisms such as sequence numbers, acknowledgments, and retransmission, making it suitable for applications that require high data integrity, such as web browsing, file transfer, and email.

1.2 IP (Internet Protocol)

IP is a network layer protocol responsible for addressing and routing data packets across the network. Currently, there are two main versions:

IPv4 (Internet Protocol version 4): Uses a 32-bit address, formatted as 192.168.1.1
IPv6 (Internet Protocol version 6): Uses a 128-bit address to solve the IPv4 address exhaustion problem.

1.3 UDP (User Datagram Protocol)

UDP is a connectionless transport layer protocol that does not guarantee data reliability but offers high transmission efficiency and low latency, making it suitable for real-time audio and video communication, online gaming, and other scenarios.

2. Connection Management Terms

2.1 Three-way Handshake

The process of establishing a connection in TCP:

SYN (Synchronize): The client sends a synchronization message.
SYN-ACK (Synchronize-Acknowledgment): The server responds with a synchronization acknowledgment.
ACK (Acknowledgment): The client sends an acknowledgment, establishing the connection.

2.2 Four-way Handshake

The process of disconnecting a connection in TCP:

FIN (Finish): The active party sends a termination message.
ACK: The passive party acknowledges.
FIN: The passive party sends a termination message.
ACK: The active party acknowledges, closing the connection.

2.3 Connection States

LISTEN: Listening state, waiting for connection requests.
ESTABLISHED: The connection has been established and data can be transmitted.
TIME_WAIT: The active closing party is in a waiting state to ensure the other party receives the final ACK.
CLOSE_WAIT: The passive closing party is waiting for the application to close.

3. Performance and Flow Control Terms

3.1 RTT (Round-Trip Time)

The total time required for a data packet to travel from the sender to the receiver and back. RTT is an important metric for measuring network latency, affecting TCP’s timeout retransmission and congestion control algorithms.

3.2 Window Mechanism

3.2.1 Window

TCP uses a sliding window mechanism to control data flow:

Send Window: The amount of data the sender can send continuously.
Receive Window (RWIN): The amount of data the receiver can buffer.
Congestion Window (CWND): The window size dynamically adjusted based on network congestion.

3.2.2 Window Size

The amount of data the receiver advertises in the TCP header that can be accepted, used for flow control to prevent the sender from overwhelming the receiver’s buffer.

3.3 MSS (Maximum Segment Size)

The maximum length of the data portion in a TCP packet, typically MTU minus the lengths of the IP and TCP headers. In a standard Ethernet environment (MTU=1500 bytes):

Without TCP options: 1460 bytes.
With TCP timestamp option (12 bytes): 1448 bytes.

Note: Modern TCP typically enables the timestamp option, so the actual MSS is often 1448 bytes instead of 1460 bytes.

3.4 MTU (Maximum Transmission Unit)

The maximum packet size that can be transmitted at the network layer. The standard MTU for Ethernet is 1500 bytes. The Path MTU Discovery mechanism can determine the minimum MTU value in the end-to-end path.

4. Reliability Assurance Terms

4.1 Sequence Number (SEQ)

TCP assigns a unique sequence number to each byte of data for ordering and loss detection. The Initial Sequence Number (ISN) is randomly generated when the connection is established.

4.2 Acknowledgment Number (ACK)

The sequence number of the next byte the receiver expects to receive, indicating that the previous data has been successfully received.

4.3 Retransmission Mechanism

Timeout Retransmission: If an acknowledgment is not received within the RTO time after sending data, retransmission is triggered.
Fast Retransmit: Retransmission occurs immediately after receiving 3 duplicate ACKs, without waiting for a timeout.
SACK (Selective Acknowledgment): Allows the receiver to inform the sender of non-contiguous data blocks that have been successfully received.

4.4 RTO (Retransmission Timeout)

The timeout period the sender waits for an ACK, dynamically calculated based on RTT. A small RTO can lead to unnecessary retransmissions, while a large RTO can reduce transmission efficiency.

5. Congestion Control Terms

5.1 Congestion Control Algorithms

Slow Start: Exponential growth of CWND in the early stages of the connection to quickly probe network capacity.
Congestion Avoidance: Linear growth of CWND to avoid network overload.
Fast Recovery: Quickly restores transmission rate after detecting packet loss.

5.2 SSThresh (Slow Start Threshold)

The threshold that distinguishes between the slow start and congestion avoidance phases. When CWND is less than SSThresh, slow start is used; when greater, congestion avoidance is used.

5.3 Packet Loss

Packet loss due to network congestion or errors, which TCP interprets as a congestion signal, triggering the congestion control mechanism.

6. Address and Routing Terms

6.1 IP Address

The unique identifier for devices in a network:

Public IP: A globally unique address on the Internet.
Private IP: Addresses used within a local area network (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

6.2 Port Number

A 16-bit number (0-65535) that identifies a specific application or service on a host:

Well-known Ports (0-1023): Such as HTTP on port 80 and HTTPS on port 443.
Registered Ports (1024-49151): Registered for specific services.
Dynamic Ports (49152-65535): Temporarily used by clients.

6.3 Subnet Mask

Used to divide the network and host portions of an IP address, such as 255.255.255.0, indicating that the first 24 bits are the network address.

6.4 Gateway

A device that connects different networks, usually referring to the default gateway, which is the exit for the local network to access external networks.

6.5 DNS (Domain Name System)

A distributed system that translates human-readable domain names (e.g., www.example.com) into IP addresses.

6.6 Routing

The process of determining the path for data packets based on the destination IP address. A router is a network device that performs routing functions.

7. Data Transmission Terms

7.1 Packet

The unit of data transmitted at the network layer, containing an IP header and data payload.

7.2 Frame

The unit of data transmitted at the data link layer, containing MAC address and other link layer information.

7.3 Segment

The unit of data transmitted at the TCP layer, containing a TCP header and application layer data.

7.4 Throughput

The amount of data successfully transmitted per unit time, usually measured in Mbps or Gbps, and is a key metric for measuring network performance.

7.5 Bandwidth

The maximum transmission capacity of a network link, representing the theoretical upper limit of data transmission rate.

7.6 Latency

The time taken for data to travel from the source to the destination, including propagation delay, processing delay, and queuing delay.

8. Security-Related Terms

8.1 TLS/SSL (Transport Layer Security / Secure Sockets Layer)

A protocol that provides encryption, authentication, and data integrity protection above the transport layer; HTTPS uses TLS to secure HTTP communication.

8.2 Firewall

A security system that monitors and controls network traffic, allowing or blocking packets based on predefined rules.

8.3 NAT (Network Address Translation)

A technology that translates private IP addresses to public IP addresses, addressing the shortage of IPv4 addresses while providing a degree of security isolation.

9. Quality of Service Terms

9.1 QoS (Quality of Service)

Technologies that ensure network performance for critical applications through priority management and bandwidth allocation.

9.2 Jitter

The variation in packet arrival time intervals, significantly affecting real-time applications such as VoIP.

9.3 TTL (Time To Live)

The maximum number of router hops an IP packet is allowed to pass through in the network; TTL decreases by 1 for each router it passes, preventing packets from looping indefinitely.

10. Advanced Concept Terms

10.1 Keep-Alive

A mechanism that periodically sends probe messages to keep the connection active and check if the other party is still online.

10.2 Half-Open Connection

An abnormal state where one party believes the connection is established while the other believes it is not established or has been closed.

10.3 Nagle’s Algorithm

An algorithm that optimizes the transmission of small packets by combining multiple small packets before sending, reducing network overhead but potentially increasing latency.

10.4 Delayed ACK

The receiver delays sending an ACK, waiting for data or a timeout before confirming, reducing the number of ACK messages.

10.5 Zero Window

When the receiver’s buffer is full, it advertises a window size of 0, pausing the sender from sending data until there is space in the buffer.

11. Wireshark Packet Capture Analysis Terms

11.1 Basic Wireshark Terms

11.1.1 Packet Capture

Capturing data packets transmitted over a network interface for analyzing network communication processes and diagnosing issues.

11.1.2 Filters

Capture Filter: Filters during capture to reduce the amount of data captured, with syntax based on BPF (Berkeley Packet Filter).
Display Filter: Filters displayed data from already captured packets, with more flexible syntax, such as tcp.port == 80.

11.1.3 Stream Follow

Reassembles TCP streams and displays the complete session content in chronological order, facilitating application layer data analysis. Common command: Follow TCP Stream.

11.2 TCP Analysis Expert System Terms

The built-in TCP analysis engine in Wireshark automatically detects and annotates anomalies:

11.2.1 Retransmission Related Markers

TCP Retransmission: Detects that a packet with the same sequence number has been resent, usually triggered by packet loss or timeout.
TCP Fast Retransmission: Retransmits immediately after receiving 3 duplicate ACKs, and Wireshark will annotate this type of retransmission.
TCP Spurious Retransmission: Unnecessary retransmission where the original packet has actually been delivered.
TCP Out-Of-Order: The arrival order of packets is inconsistent with the sending order.

11.2.2 Duplicate Acknowledgment

TCP Dup ACK: The receiver sends the same acknowledgment number multiple times, indicating that the expected packet has not arrived, signaling for fast retransmission.

11.2.3 Zero Window Related

TCP Zero Window: The receiver advertises a window size of 0, pausing data transmission.
TCP Window Full: The sender has sent all data allowed by the receive window and is waiting for an ACK.
TCP Zero Window Probe: The sender periodically sends 1-byte data to probe whether the receiver’s window has recovered.
TCP Window Update: The receiver advertises a new available window size.

11.2.4 Connection Anomaly Markers

TCP Previous Segment Not Captured: Detects a sequence number jump, indicating that the packet capture has lost intermediate packets.
TCP ACKed Unseen Segment: An ACK confirms data that did not appear in the packet capture.
TCP Keep-Alive: Detects keep-alive probe messages.
TCP Keep-Alive ACK: Response to keep-alive probes.

11.2.5 Performance Issue Markers

TCP Dup ACK #X: Wireshark counts duplicate ACKs, with the third duplicate ACK typically triggering fast retransmission.
TCP Out-Of-Order: Packets arrive out of order, potentially affecting performance.
TCP Previous Segment Lost: Indicates packet loss based on sequence numbers.

12. RTT Related Deep Terms

12.1 RTT Measurement

12.1.1 RTT (Round-Trip Time)

The time interval from sending a data packet to receiving the corresponding ACK. Wireshark can display the RTT value for each ACK in the tcp.analysis.ack_rtt field.

12.1.2 iRTT (Initial RTT)

The RTT measured during the three-way handshake, serving as the baseline delay value when establishing a connection, which can be calculated in Wireshark by the time difference between SYN and SYN-ACK.

12.1.3 Smoothed RTT (SRTT)

The result of applying exponential weighted moving average to multiple RTT measurements, used to eliminate instantaneous fluctuations. The calculation formula is:

Where is typically 1/8.

12.1.4 RTT Variance (RTTVAR)

A metric that measures the degree of RTT fluctuation, used to calculate RTO:

Where is typically 1/4.

12.2 RTT-Based Calculations

12.2.1 RTO Calculation Formula

The RTO calculation formula specified in RFC 6298 is:

Where is the clock granularity. This formula ensures that RTO is neither too aggressive nor too conservative while considering the impact of system clock precision.

12.2.2 BDP (Bandwidth-Delay Product)

A measure of network link capacity, calculated as:

For example: A BDP of 100Mbps bandwidth and 50ms RTT = 100Mbps × 0.05s = 625KB. This value indicates the amount of data that can be accommodated in the network “pipe,” and the TCP window size should be BDP to fully utilize the bandwidth.

12.2.3 Long Fat Network (LFN)

A network with high bandwidth and high latency (large BDP) that requires a large window to fully utilize, such as satellite communication and transoceanic fiber optics.

13. In-Depth Analysis of Retransmission Mechanisms

13.1 Detailed Types of Retransmission

13.1.1 Timeout Retransmission

If an ACK is not received within the RTO time after sending data, retransmission is triggered. Characteristics include:

The timing of retransmission is controlled by a timer.
After retransmission, RTO doubles (exponential backoff).
The congestion window resets to 1 MSS, entering slow start.
In Wireshark, it is displayed as [TCP Retransmission], with the timestamp matching the previous packet with the same SEQ, spaced by RTO.

13.1.2 Fast Retransmit

Retransmission occurs immediately after receiving 3 duplicate ACKs, without waiting for RTO timeout. Characteristics include:

Fast response speed, short recovery time.
Enters fast recovery phase instead of slow start.
SSThresh is set to half of CWND.
In Wireshark, it is marked as [TCP Fast Retransmission], preceded by 3 [TCP Dup ACK] markers.

13.1.3 SACK Retransmission

When the SACK option is enabled, only the lost data segments are retransmitted, not the acknowledged data:

The receiver lists the received data blocks in the TCP options.
The sender only retransmits the gaps.
This improves retransmission efficiency, especially in cases of multiple packet losses.
Wireshark displays:TCP option - SACK with Left Edge and Right Edge.

13.2 Retransmission Performance Metrics

13.2.1 Retransmission Rate

重传率重传的数据包数总发送数据包数

The normal network retransmission rate should be < 1%. A rate exceeding 3% indicates poor network quality.

13.2.2 Retransmission Timeout Count

The cumulative number of timeout retransmissions; a high count indicates significant network latency or unreasonable RTO settings.

13.2.3 Spurious Retransmission Rate

The proportion of unnecessary retransmissions among total retransmissions, indicating that RTO settings are too small or network jitter is severe.

14. Wireshark Statistics and Graph Terms

14.1 Statistical Functions

14.1.1 IO Graphs

Displays traffic trends over time, with multiple filter conditions for comparative analysis:

X-axis: Time
Y-axis: Selectable packet count, byte count, bit rate, etc.
Used to identify traffic spikes and periodic patterns.

14.1.2 TCP Stream Graphs

A specific type of graph for analyzing individual TCP connections:

Time-Sequence Graph (Stevens): A classic time sequence graph showing the change of sequence numbers over time.
Time-Sequence Graph (tcptrace): An improved version of the time sequence graph, displaying retransmissions more clearly.
Throughput Graph: Displays real-time changes in throughput.
Round Trip Time Graph: Shows the trend of RTT over time.
Window Scaling Graph: Displays changes in send and receive windows.

14.1.3 Conversations

Statistics of communication between two endpoints:

Displays sessions at the IP, TCP, and UDP layers.
Statistics on the number of packets, byte count, and duration for each session.
Quickly identifies connections that consume the most traffic.

14.1.4 Endpoints

Statistics of activity for a single IP address or port, helping to identify traffic sources and destinations.

14.2 Performance Analysis Metrics

14.2.1 Bytes in Flight

The amount of data sent but not yet acknowledged, displayed in Wireshark’s tcp.analysis.bytes_in_flight field. This value reflects network utilization:

Close to CWND: The network is fully utilized.
Far below CWND: May be limited by application layer or receive window constraints.

14.2.2 Push Flag

A flag in the TCP header that prompts the receiver to immediately push data to the application, without buffering. Common in interactive applications (e.g., SSH, Telnet).

14.2.3 Urgent Flag

Marks urgent data, used in conjunction with the urgent pointer, allowing certain data to be prioritized. Less commonly used in modern applications.

15. Advanced Fault Diagnosis Terms

15.1 Connection Establishment Issues

15.1.1 SYN Flood Attack

An attacker sends a large number of SYN packets without completing the three-way handshake, exhausting server resources. Characteristics include:

A large number of half-open connections in SYN_RECEIVED state.
Seeing many SYNs but few SYN-ACKs or ACKs in Wireshark.

15.1.2 Connection Reset

Receiving a packet with the RST flag forcibly terminates the connection. Common causes include:

Port not open.
Firewall interception.
Application abnormal exit.
Receiving an illegal sequence number.

15.1.3 Connection Refused

The target host’s port is not listening, returning ICMP Destination Unreachable (Port Unreachable).

15.2 Data Transmission Issues

15.2.1 Selective ACK (SACK)

A TCP option that allows the receiver to inform the sender which non-contiguous data blocks have been successfully received:

TCP Option - SACK: Left Edge = 1001, Right Edge = 2001
Indicates that data from sequence numbers 1001-2001 has been received, but earlier data may be lost.

15.2.2 Window Scale

A TCP option negotiated during the three-way handshake that allows the window size to exceed 65535 bytes. The scaling factor (shift count) can range from 0 to 14:

Actual window size = Advertised window × 扩大因子
For example: Window Scale = 7, Advertised window = 65535, Actual window size = 8388608 bytes (approximately 8MB).
The maximum scaling factor is 14, allowing the window to reach 1073741824 bytes (approximately 1GB). Note that the window fields in the SYN and SYN-ACK packets during the three-way handshake are not scaled.

15.2.3 Checksum Error

A mismatch in the checksum of the TCP or IP header indicates that data has been corrupted during transmission. Wireshark marks this as [checksum incorrect]. Note: Network card offloading features may cause false positives.

15.3 Performance Diagnosis Terms

15.3.1 Receiver Window Full

The receiver processes data slowly, causing the buffer to fill up, and the advertised window gradually decreases to 0.

15.3.2 Silly Window Syndrome

The sender sends very small data segments or the receiver advertises a very small window, leading to inefficiency. Solutions include:

Nagle’s algorithm (sender side).
Delayed window updates (receiver side).

15.3.3 Path MTU Discovery

By setting the “Don’t Fragment” (DF) flag in IP packets, the minimum MTU of the end-to-end path is probed:

Send a large packet (DF=1).
If an intermediate router has a smaller MTU, it returns ICMP “Fragmentation Needed.”
Reduce the packet size and retry.
Ultimately determine the appropriate MTU.

Wireshark can filter: icmp.type == 3 and icmp.code == 4 to view the MTU discovery process.

16. Practical Analysis Techniques with Wireshark

16.1 Common Display Filters

tcp.analysis.flags // Display all TCP analysis flags.
tcp.analysis.retransmission // Display only retransmitted packets.
tcp.analysis.duplicate_ack // Display only duplicate ACKs.
tcp.analysis.zero_window // Display only zero windows.
tcp.flags.reset == 1 // Display RST packets.
tcp.flags.syn == 1 && tcp.flags.ack == 0 // Display only SYN packets.
tcp.stream eq 0 // Display TCP stream 0.
tcp.port == 443 && tcp.flags.push == 1 // HTTPS push data.

16.2 Performance Analysis Checklist

When analyzing TCP performance with Wireshark, focus on checking:

Connection establishment delay: The time from SYN to SYN-ACK (should be close to RTT).
Initial RTT: To determine baseline network latency.
Retransmission rate: A high rate indicates poor network quality.
Duplicate ACKs: A large number indicates severe packet loss.
Zero window: Indicates a performance bottleneck at the receiver.
Window utilization: Bytes in Flight vs. Window Size.
Congestion events: Observe the change patterns of CWND.

16.3 Typical Problem Pattern Recognition

16.3.1 Application Layer Slow

Characteristics: Long delays between many PSH-ACKs, but no retransmissions or zero windows.
Cause: Slow application processing rather than network issues.

16.3.2 Network Packet Loss

Characteristics: High retransmission rate, duplicate ACKs, out-of-order packets.
Cause: Poor link quality or congestion.

16.3.3 Receiver Slow

Characteristics: Frequent zero windows and window updates.
Cause: Bottlenecks in the receiver’s CPU/memory/disk.

16.3.4 Window Too Small

Characteristics: Bytes in Flight consistently reach the window limit, low throughput but no packet loss.
Cause: Improper window size configuration, unable to fully utilize bandwidth.

17. Recommended Reading

To further deepen your understanding of TCP/IP protocols and master Wireshark analysis techniques, the following three industry practical books are recommended:

1. “Wireshark Network Analysis Made Simple”

Author: Lin Peiman
Recommendation: The first choice for beginners. The author uses humorous language, combining common network phenomena (such as “Why is the internet so slow”) to explain the use of Wireshark and protocol analysis ideas in an easy-to-understand manner. No tedious theoretical piling, making it very suitable for beginners.
Link: Douban Book Details Page

2. “The Art of Network Analysis with Wireshark”

Author: Lin Peiman
Recommendation: An advanced work following the previous book. The content is more in-depth, covering more subtle details in the TCP/IP protocol stack and troubleshooting in complex scenarios. Through numerous real-world case studies, it demonstrates how to find clues from packets like a detective.
Link: Douban Book Details Page

3. “Practical Packet Analysis (3rd Edition)”

Original Title: Practical Packet Analysis, 3rd Edition
Author: Chris Sanders
Translator: Zhuge Jianwei et al.
Recommendation: A classic practical guide and a global bestseller. This book is well-structured, covering everything from setting up the capture environment, advanced applications of filters, to in-depth analysis of various protocols (TCP, UDP, DNS, HTTP, etc.), as well as wireless network and security analysis, providing a systematic learning path.
Link: Douban Book Details Page

Conclusion

The terminology system of the TCP/IP protocol suite is vast and intricate. This article covers core concepts from basic protocols to advanced mechanisms. A deep understanding of these terms not only aids in diagnosing network issues but also guides us in designing efficient and reliable network applications. As network technology evolves, new terms and concepts continue to emerge, making continuous learning a necessity for every network practitioner.

Mastering these terms is just the beginning; practical application is essential for true comprehension. Readers are encouraged to combine actual projects with packet capture tools like Wireshark to observe real TCP/IP communication processes and refer to the recommended books in Chapter 17 for systematic learning, deepening their understanding through practice.