TCP Structure - Transmission Control Protocol

Description

The Transmission Control Protocol (TCP) is one of the core Internet transport layer protocols. It is typically used by applications that require guaranteed, in-order delivery of packets. It provides handling for both timeouts and retransmissions, flow control, acknowledgements, and it distinguishes data form multiple concurrent applications running on the same host.

TCP establishes full duplex virtual connections between two nodes. Each node is defined by an IP address and a TCP port number. Data is then transferred in segments usually delineated by the maximum transmission unit (MTU) of the data link layer.

TCP assigns each packet a sequence number, which is used to make sure each packet is delivered, and in the correct order. The receiving end sends acknowledgements for packets which have been successfully received; if an acknowledgement is not received by the sender within a reasonable round-trip time (RTT), the presumably lost packet is retransmitted. The TCP Window size determines the number of bytes of data that can be sent before an acknowledgement from the receiver is necessary. TCP checks that no bytes are damaged by using a checksum for each block of data.

The TCP protocol is used with a number of applications: World Wide Web (HTTP), email (POP3, IMAP), File Transfer Protocol (FTP), Telnet, Secure Shell (SSH), IRC, NFS, NetBIOS, NNTP, etc.

TCP Header structure

Source port - 16 bits
Port number of the sender.

Destination port - 16 bits
The destination port this packet is addressed to.

Sequence number - 32 bits
Sequence number of the first data byte in this segment. If the SYN bit is set, then this is the initial sequence number and the first data byte is this initial sequence number plus one.

Acknowledgement number - 32 bits
If the ACK bit is set, the the next expected sequence number. Once a connection is established, this is always sent.

Data offset - 4 bits
Length of the TCP header as a number of 32-bit words. This indicates where the data begins. The length of the TCP header is always a multiple of 32 bits. The minimum size header is 5 words (20 bytes), and the maximum is 15 words (60 bytes). This field gets its name since it is also the offset from the start of the packet to the data.

Reserved - 3 bits
Should be 0. Note, RFC 793 defines this as a 6 bit field, but the last 3 are used for ECN as defined below.

ECN, Explicit Congestion Notification - 3 bits
Defined in RFC 2481, RFC 3168 and RFC 3540. Field contains 3 bit flags:

00 NS - added in RFC 3540. This is an optional ECN field intended to protect against accidental or malicious concealment of marked packets from the TCP sender.
01 CWR
02 ECE, ECN-Echo

Control bits (aka Flags) - 6 bits
This field contains 6 bit flags:

00  URG - Urgent pointer
01  ACK - Acknowledgement field
02  PSH - Push function
03  RST - Reset the connection
04  SYN - Synchronize sequence numbers
05  FIN - No more data from sender

TCP Window
Number of data bytes the sender of this segment is willing to accept, starting with the one in the Acknowledgement field. The Initial/Default/Maximum possible TCP Window is negotiated during the three-way handshake at the beginning of a connection. After that, packets contain the currently available portion of the TCP Window.

Checksum - 16 bits
Used for error-checking of the header and data. The method for computing the checksum is defined in RFC 793. Computed as the 16-bit one's complement of the one's complement sum of a pseudo header of information from the IP header, the TCP header, and the data, padded (as needed) with zero bytes at the end to make a multiple of two bytes.

Urgent pointer - 16 bits, unsigned
If the URG bit is set, this field is an offset, pointing to the sequence number of the last byte in a sequence of urgent data.

TCP Options - 0 to 44 bytes variable length, optional
Additional header fields, called options, as defined by RFC 1323. This field is not required. All options are included in the checksum. An option may begin on any byte boundary. The total TCP header length (including TCP Options) is padded with zeros as necessary to make the header length multiple of 32 bits.

TCP Options are identified by an option kind field, as listed in the below table. Any number of TCP Options can be added to the end of the TCP header.

Each TCP Option may be either:

• a single byte option kind (options 0 and 1).
• a multi-byte option kind, consisting of a single byte option kind, a single byte length, and (length-2) bytes of data.

 The most commonly used TCP Options are: 0,1,2,3,4,5, and 8.

TCP Options 14/15 -- TCP Alternate Checksum Numbers

0 - TCP Checksum (RFC 1146)
1 - 8-bit Fletchers's algorithm (RFC 1146)
2 - 16-bit Fletchers's algorithm (RFC 1146)
3 - Redundant Checksum Avoidance (Kay)

Data - variable length

References

RFC 793 - Postel, J., "Transmission Control Protocol - DARPA Internet Program Protocol Specification", STD 7, RFC 793, DARPA, September 1981.
RFC 1323 - Jacobson, V., Braden, R., and D. Borman, "TCP Extensions for High Performance", RFC 1323, LBL, ISI, Cray Research, May 1992.
RFC 1072 - Jacobson, V., and R. Braden, "TCP Extensions for Long-Delay Paths", RFC 1072, LBL, ISI, October 1988.
RFC 1644 - Braden, R. "T/TCP -- TCP Extensions for Transactions Functional Specification", RFC 1644, ISI, July 1994
RFC 1693 - Connolly, T., et al, "An Extension to TCP : Partial Order Service", RFC 1693, University of Deleware, November 1994.
RFC 1146 - Zweig, J., and C. Partridge, "TCP Alternate Checksum Options", RFC 1146, UIUC, BBN, March 1990.
RFC 2018 - Mathis, M., Mahdavi, J., Floyd, S., and Romanow, A., TCP Selective Acknowledgement Options. RFC 2018, April 1996.
RFC 2385 - Heffernan, A., "Protection of BGP Sessions via the TCP MD5 Signature Option", RFC 2385, Cisco Systems, August 1998.
RFC 3168 - The Addition of Explicit Congestion Notification (ECN) to IP.
RFC 3540 - Robust Explicit Congestion Notification (ECN) Signaling with Nonces.

Bellovin - Steve Bellovin, , March 2000.
Braden  - Bob Braden, , March 1995.
Bridges - Monroe Bridges, , September 1994.
Knowles - Stev Knowles, , March 1995.
Kay - J. Kay, , Septermber 1994. Kay, J. and Pasquale, J., "Measurement, Analysis, and Improvement of UDP/IP Throughput for the DECstation 5000," Proceedings of the Winter 1993 Usenix Conference, January 1993 (available for anonymous FTP at ucsd.edu:/pub/csl/fastnet/fastnet.tar.Z). jkay@ucsd.edu
Scott - Keith Scott , February 1999.
Subbu - Subbu Subramaniam, , September 1994.
Sukonnik - Vladimir Sukonnik , February 1999.

• Windows 10 Manual TCP/IP Registry Tweaks
• Internet Data Caps compared
• TCP Congestion Control Algorithms Comparison
• Windows 10 Anniversary updates to TCP
• How to Backup using Batch Files under Windows 10