From: Juejin, Author: Ruheng Link: https://juejin.im/post/6844903490595061767
1. TCP/IP Model
The above example illustrates the HTTP protocol specifically.
2. Data Link Layer
-
Encapsulation into frames: Add headers and trailers to the network layer datagram, encapsulating it into frames, with the frame header including source and destination MAC addresses.
-
Transparent transmission: zero-bit padding, escape characters.
-
Reliable transmission: rarely used on links with very low error rates, but wireless links (WLAN) will ensure reliable transmission.
-
Error detection (CRC): the receiver checks for errors, and if an error is found, the frame is discarded.
3. Network Layer
1. IP Protocol
The IP protocol is the core of the TCP/IP protocol, and all TCP, UDP, ICMP, and IGMP data are transmitted in IP data format. It is important to note that IP is not a reliable protocol, meaning that it does not provide a mechanism for handling undelivered data, which is the responsibility of upper-layer protocols: TCP or UDP.
1.1 IP Address
1.2 IP Protocol Header
2. ARP and RARP Protocols
3. ICMP Protocol
The IP protocol is not a reliable protocol; it does not guarantee data delivery. Therefore, naturally, the task of ensuring data delivery should be handled by other modules. One important module is the ICMP (Internet Control Message Protocol). ICMP is not a high-level protocol but operates at the IP layer.
When errors occur in transmitting IP data packets, such as unreachable hosts or unreachable routes, the ICMP protocol will encapsulate the error information and send it back to the host. This gives the host an opportunity to handle the error, which is why it is said that protocols built on top of the IP layer can achieve reliability.
4. Ping
The ping command can be said to be the most famous application of ICMP, and it is part of the TCP/IP protocol. Using the “ping” command can check whether a network is reachable and can help us analyze and determine network faults.
For example, when we cannot access a certain website, we usually ping the site. The ping command will return some useful information. General information is as follows:
5. Traceroute
Traceroute is an important tool for detecting the routing situation between a host and the destination host, and it is also the most convenient tool.
The principle of Traceroute is very interesting. It sends a UDP packet with TTL=1 to the destination host. The first router that receives this packet will automatically decrement the TTL by 1, and when the TTL becomes 0, the router will discard the packet and generate an ICMP message indicating that the host is unreachable. After receiving this message, the host sends a UDP packet with TTL=2 to the destination host, stimulating the second router to send an ICMP message back to the host. This continues until it reaches the destination host. Thus, Traceroute obtains the IP addresses of all routers.
6. TCP/UDP
Message-oriented
Message-oriented transmission means that the application layer specifies how long the message is, and UDP sends it as is, one message at a time. Therefore, the application must choose an appropriate message size. If the message is too long, the IP layer needs to fragment it, reducing efficiency. If too short, it may be too small for the IP.
Byte stream-oriented
When to Use TCP?
When to Use UDP?
7. DNS
8. Establishing and Terminating TCP Connections
1. Three-way Handshake
Why Three-way Handshake?
2. Four-way Handshake
After the client and server have established a TCP connection through the three-way handshake, when data transmission is complete, the TCP connection must be terminated. This is known as the mysterious “four-way handshake”.
First Handshake: Host 1 (which can be the client or server) sets the Sequence Number and sends a FIN packet to Host 2; at this point, Host 1 enters the FIN_WAIT_1 state; this indicates that Host 1 has no more data to send to Host 2;
Second Handshake: Host 2 receives the FIN packet sent by Host 1 and replies with an ACK packet, setting Acknowledgment Number to Sequence Number + 1; Host 1 enters the FIN_WAIT_2 state; Host 2 informs Host 1 that it “agrees” to the close request;
Third Handshake: Host 2 sends a FIN packet to Host 1, requesting to close the connection, while Host 2 enters the LAST_ACK state;
Fourth Handshake: Host 1 receives the FIN packet sent by Host 2 and sends an ACK packet back to Host 2; then Host 1 enters the TIME_WAIT state; after receiving Host 1’s ACK packet, Host 2 closes the connection; at this point, Host 1 waits for 2MSL (Maximum Segment Lifetime) to ensure no further replies are received, confirming that the server has closed normally, and then Host 1 can also close the connection.
Why Four-way Handshake?
Why Wait for 2MSL?
MSL: Maximum Segment Lifetime, which is the longest time any segment can remain in the network before being discarded. There are two reasons:
-
To ensure that the TCP protocol’s full-duplex connection can be reliably closed.
-
To ensure that any duplicate data segments from this connection disappear from the network.
First Point: If Host 1 directly enters CLOSED, due to the unreliability of the IP protocol or other network reasons, Host 2 may not receive Host 1’s last ACK reply. Then, after a timeout, Host 2 will continue to send FIN; at this point, since Host 1 has already CLOSED, it cannot find a corresponding connection for the retransmitted FIN. Therefore, Host 1 does not directly enter CLOSED, but maintains the TIME_WAIT state to ensure that it receives the acknowledgment for the FIN again, thus correctly closing the connection.
Second Point: If Host 1 directly enters CLOSED and then initiates a new connection to Host 2, we cannot guarantee that this new connection will have a different port number than the closed connection. This means that it is possible for the new connection and the old connection to have the same port number. Generally, this will not cause problems, but there are special cases: if the new connection and the already closed old connection have the same port number, and some delayed data from the previous connection still lingers in the network, this delayed data may arrive at Host 2 after the new connection is established, and due to the same port number, the TCP protocol will consider that delayed data as belonging to the new connection, causing confusion with the actual new connection’s data packets. Therefore, the TCP connection must remain in the TIME_WAIT state for 2MSL to ensure that all data from this connection disappears from the network.
9. TCP Flow Control
If the sender sends data too quickly, the receiver may not be able to keep up, leading to data loss. Flow control ensures that the sender’s sending rate is not too fast, allowing the receiver to catch up.
Using the sliding window mechanism can easily implement flow control on a TCP connection.
Assume A is sending data to B. During the connection establishment, B informs A: “My receive window is rwnd = 400” (where rwnd represents the receiver window). Therefore, the sender’s sending window cannot exceed the value given by the receiver. Note that the TCP window is measured in bytes, not segments. Assuming each segment is 100 bytes long, and the initial sequence number for data segments is set to 1. Uppercase ACK indicates the acknowledgment bit in the header, while lowercase ack indicates the acknowledgment field value.
From the diagram, it can be seen that B performs flow control three times. The first time it reduces the window to rwnd = 300, the second time to rwnd = 100, and finally to rwnd = 0, meaning the sender is no longer allowed to send data. This state of pausing the sender will last until Host B sends a new window value.
TCP sets a persistence timer for each connection. Whenever one side of the TCP connection receives a zero window notification from the other side, it starts the persistence timer. If the timer expires, it sends a zero window probe packet (carrying 1 byte of data), and the receiving party resets the persistence timer.
10. TCP Congestion Control
The sender maintains a congestion window (cwnd) state variable. The size of the congestion window depends on the network’s congestion level and changes dynamically. The sender sets its sending window equal to the congestion window.
The principle for controlling the congestion window is: as long as there is no congestion in the network, the congestion window increases to allow more packets to be sent. However, if congestion occurs, the congestion window decreases to reduce the number of packets injected into the network.
Slow start algorithm:
When a host starts sending data, if it injects a large amount of data into the network immediately, it may cause network congestion since the load conditions are not yet clear. Therefore, a better method is to probe gradually by increasing the sending window from small to large, i.e., increasing the congestion window value from small to large.
Usually, when starting to send segments, the congestion window (cwnd) is set to the value of one maximum segment size (MSS). With each acknowledgment received for a new segment, the congestion window increases by at most one MSS. This method gradually increases the sender’s congestion window (cwnd), allowing packets to be injected into the network at a more reasonable rate.
With each transmission round, the congestion window (cwnd) doubles. The time taken for one transmission round is actually the round-trip time RTT. However, the term “transmission round” emphasizes that all segments allowed by the congestion window (cwnd) are sent continuously, and acknowledgments for the last byte sent are received.
Additionally, the “slow” in slow start does not refer to the slow growth rate of cwnd but rather to the initial setting of cwnd=1, causing the sender to send only one segment at the beginning (to probe the network’s congestion condition) before gradually increasing cwnd.
To prevent the congestion window (cwnd) from growing too large and causing network congestion, a slow start threshold (ssthresh) state variable is set. The usage of the slow start threshold (ssthresh) is as follows:
-
When cwnd < ssthresh, use the slow start algorithm.
-
When cwnd > ssthresh, stop using the slow start algorithm and switch to the congestion avoidance algorithm.
-
When cwnd = ssthresh, either the slow start algorithm or the congestion avoidance algorithm can be used.
Congestion Avoidance
Let the congestion window (cwnd) increase slowly, i.e., increase the sender’s congestion window (cwnd) by 1 for each round-trip time (RTT) instead of doubling it. This allows the congestion window (cwnd) to grow slowly in a linear manner, much slower than the growth rate of the congestion window in the slow start algorithm.
Regardless of whether in the slow start phase or the congestion avoidance phase, as long as the sender detects network congestion (indicated by the absence of acknowledgments), it should set the slow start threshold (ssthresh) to half of the sender’s window value at the moment of congestion (but not less than 2). Then, it should reset the congestion window (cwnd) to 1 and execute the slow start algorithm.
The purpose of this is to quickly reduce the number of packets sent into the network, giving the congested router enough time to process the packets queued up.
The following diagram illustrates the above congestion control process with specific values. Now the sending window size is equal to the congestion window.
2. Fast Retransmit and Fast Recovery
Fast Retransmit
The fast retransmit algorithm requires the receiver to immediately send a duplicate acknowledgment for every out-of-order segment received (so that the sender knows early that a segment has not reached the other party) rather than waiting to send an acknowledgment when it sends its own data.
Assuming the receiver has received M1 and M2 and has sent acknowledgments for both. Now suppose the receiver did not receive M3 but then received M4.
Clearly, the receiver cannot acknowledge M4 because M4 is an out-of-order segment. According to the reliable transmission principle, the receiver can choose to do nothing or send an acknowledgment for M2 at an appropriate time.
However, according to the fast retransmit algorithm, the receiver should promptly send a duplicate acknowledgment for M2, allowing the sender to know early that segment M3 has not reached the receiver. The sender then sends M5 and M6. After receiving these two packets, the receiver sends another duplicate acknowledgment for M2. Thus, the sender receives four acknowledgments for M2 from the receiver, with the last three being duplicate acknowledgments.
The fast retransmit algorithm also specifies that the sender should immediately retransmit the unacknowledged segment M3 as soon as it receives three duplicate acknowledgments, without having to wait for the retransmission timer for M3 to expire.
By retransmitting unacknowledged segments early, the overall network throughput can increase by about 20%.
Fast Recovery
-
When the sender receives three consecutive duplicate acknowledgments, it executes a “multiplicative decrease” algorithm, halving the slow start threshold (ssthresh). -
Unlike slow start, the congestion window (cwnd) is not set to 1; instead, it is set to the value of the slow start threshold (ssthresh) after halving, and then the congestion avoidance algorithm (“additive increase”) is executed to allow the congestion window to increase linearly.