Introduction
Although TCP and UDP use the same network layer (IP), TCP provides services that are completely different from those of UDP at the application layer. TCP offers a connection-oriented and reliable byte stream service.Connection-oriented means that two applications using TCP (usually a client and a server) must first establish a TCP connection before exchanging data. This process is similar to making a phone call: first dialing and waiting for the other party to pick up and say “hello” before identifying oneself.This article will explain the classic TCP protocol for establishing a connection (the so-called “three-way handshake”) and disconnecting (the so-called “four-way wavehand”).
Related Resources
For more information, please refer to the book “TCP/IP Illustrated”, which has been compiled into an online reading version by Instant Messaging Network (52im.net). This classic work is worth collecting and referring to at any time. The address is: http://www.52im.net/topic-tcpipvol1.html
Understanding TCP Packet Format
For detailed information on the TCP/IP protocol, refer to the chapter on TCP format in “TCP/IP Illustrated” (click here to view the online version of “TCP/IP Illustrated”). Below is the TCP packet format diagram:
The diagram above highlights several fields that need to be introduced:(1) Sequence Number: Seq number, occupying 32 bits, used to identify the byte stream sent from the TCP source to the destination. The sender marks this when sending data.(2) Acknowledgment Number: Ack number, occupying 32 bits, is only valid when the ACK flag is set to 1, Ack=Seq+1.(3) Flags: There are a total of 6, namely URG, ACK, PSH, RST, SYN, FIN, etc. Their specific meanings are as follows: (A) URG: Urgent pointer is valid. (B) ACK: Acknowledgment number is valid. (C) PSH: The receiver should deliver this packet to the application layer as soon as possible. (D) RST: Reset the connection. (E) SYN: Initiate a new connection. (F) FIN: Release a connection.It is important to note:(A) Do not confuse the acknowledgment number Ack with the ACK flag in the flags.(B) The acknowledgment from the receiver Ack=initiator Req+1, paired on both ends.
Detailed Explanation of the Three-Way Handshake
The so-called three-way handshake refers to establishing a TCP connection, which requires the client and server to send a total of 3 packets to confirm the establishment of the connection. In socket programming, this process is triggered by the client executing connect, and the entire flow is shown in the diagram below:
(1) First Handshake:The client sets the SYN flag to 1, randomly generates a value seq=J, and sends this packet to the server. The client enters the SYN_SENT state, waiting for the server’s confirmation.(2) Second Handshake:The server, upon receiving the packet, knows that the client requests to establish a connection because the SYN=1 flag is set. The server sets both the SYN and ACK flags to 1, ack=J+1, randomly generates a value seq=K, and sends this packet back to the client to confirm the connection request. The server enters the SYN_RCVD state.(3) Third Handshake:The client, upon receiving the confirmation, checks if ack is J+1 and if ACK is 1. If correct, it sets the ACK flag to 1, ack=K+1, and sends this packet back to the server. The server checks if ack is K+1 and if ACK is 1. If correct, the connection is successfully established, and both the client and server enter the ESTABLISHED state, completing the three-way handshake. The client and server can then start transmitting data.SYN Attack:During the three-way handshake process, the TCP connection before receiving the client’s ACK after the server sends SYN-ACK is called a half-open connection. At this point, the server is in the SYN_RCVD state. When it receives the ACK, the server transitions to the ESTABLISHED state.
A SYN attack is a typical DDOS attack where the client forges a large number of non-existent IP addresses in a short time and continuously sends SYN packets to the server. The server replies with acknowledgment packets and waits for the client’s confirmation. Since the source addresses do not exist, the server must continually resend until it times out. These forged SYN packets will occupy the unconnected queue, causing normal SYN requests to be dropped due to a full queue, leading to network congestion or even system failure.
Detecting a SYN attack is straightforward: if there are many half-open connections on the server and the source IP addresses are random, it can be concluded that a SYN attack has occurred. The following command can be used to verify this:
#netstat -nap | grep SYN_RECV
Detailed Explanation of the Four-Way Wavehand
While the three-way handshake is well-known, fewer people are familiar with the four-way wavehand. The so-called four-way wavehand refers to terminating a TCP connection, which requires the client and server to send a total of 4 packets to confirm the disconnection.
In socket programming, this process is triggered by either the client or the server executing close, and the entire flow is shown in the diagram below:
Since TCP connections are full-duplex, each direction must be closed individually. This principle states that when one party completes its data sending task, it sends a FIN to terminate the connection in that direction. Receiving a FIN only indicates that there is no data flow in that direction, meaning no more data will be received. However, data can still be sent on this TCP connection until that direction also sends a FIN. The party that initiates the closure will perform an active close, while the other party will perform a passive close, as shown in the diagram above.
-
First Wavehand: The client sends a FIN to close the data transmission from the client to the server, entering the FIN_WAIT_1 state.
-
Second Wavehand: The server, upon receiving the FIN, sends an ACK to the client, with the acknowledgment number being the received number +1 (similar to SYN, one FIN occupies one sequence number). The server enters the CLOSE_WAIT state.
-
Third Wavehand: The server sends a FIN to close the data transmission from the server to the client, entering the LAST_ACK state.
-
Fourth Wavehand: The client, upon receiving the FIN, enters the TIME_WAIT state, then sends an ACK to the server, with the acknowledgment number being the received number +1. The server enters the CLOSED state, completing the four-way wavehand.
The above describes the case where one party actively closes while the other passively closes. In practice, there may also be cases where both parties initiate an active close simultaneously, as shown in the following diagram:
The flow and states are clearly depicted in the diagram above, and will not be repeated here. Please refer to the previous steps for the analysis of the four-way wavehand.
Conclusion
Typical interview questions often involve the three-way handshake and four-way wavehand. Here are some questions for those who need them:
-
(1) What is the three-way handshake or its process? What about the four-way wavehand?
-
(2) Why is establishing a connection a three-way handshake while closing a connection is a four-way wavehand?
This is because when the server is in the LISTEN state and receives a SYN packet for a connection request, it sends both ACK and SYN in one packet to the client.
However, when closing a connection, receiving the other party’s FIN packet only indicates that the other party will no longer send data, but it can still receive data. The local side may not have sent all its data to the other party yet, so it can either close immediately or send some data to the other party before sending the FIN packet to indicate agreement to now close the connection. Therefore, the local ACK and FIN are usually sent separately.
