TCP Header RFC 9293
20 bytes minimum header (Data Offset = 5)
+--------+--------+--------+--------+
| Source Port | Dest Port | 0-3
+--------+--------+--------+--------+
| Sequence Number | 4-7
+--------+--------+--------+--------+
| Acknowledgment Number | 8-11
+--------+--------+--------+--------+
|Off|Rsv|Flags| Window Size | 12-15
+--------+--------+--------+--------+
| Checksum | Urgent Pointer | 16-19
+--------+--------+--------+--------+
Control Flags 8 bits
| Flag | Name | Purpose |
|---|
SYN | Synchronize | Initiate connection, synchronize sequence numbers |
ACK | Acknowledgment | Acknowledgment field is valid |
FIN | Finish | No more data from sender, close connection |
RST | Reset | Abort connection immediately |
PSH | Push | Push data to application immediately |
URG | Urgent | Urgent pointer field is valid |
ECE | ECN-Echo | ECN capability or congestion indication |
CWR | Congestion Window Reduced | Sender reduced congestion window |
Three-Way Handshake Connection Establishment
Client Server
| |
|--- SYN, Seq=1000 ----------------->| LISTEN
| | SYN-RECEIVED
|<-- SYN+ACK, Seq=2000, Ack=1001 ----|
| |
|--- ACK, Seq=1001, Ack=2001 ------->| ESTABLISHED
| |
ESTABLISHED |
Connection Termination Four-Way Handshake
Connection States State Machine
| State | Description |
|---|
CLOSED | No connection exists |
LISTEN | Server waiting for incoming connections |
SYN-SENT | Client sent SYN, waiting for SYN-ACK |
SYN-RECEIVED | Server received SYN, sent SYN-ACK, waiting for ACK |
ESTABLISHED | Connection open, data transfer in progress |
FIN-WAIT-1 | Sent FIN, waiting for ACK or FIN |
FIN-WAIT-2 | Received ACK for FIN, waiting for FIN |
CLOSE-WAIT | Received FIN, waiting for application to close |
CLOSING | Both sides sent FIN simultaneously |
LAST-ACK | Sent FIN after receiving FIN, waiting for ACK |
TIME-WAIT | Waiting 2*MSL before closing (ensures ACK received) |
Defaults Common Parameters
| Parameter | Default | Notes |
|---|
MSS | 536 bytes | Maximum Segment Size (default if not negotiated) |
MSS (Ethernet) | 1460 bytes | 1500 MTU - 20 IP - 20 TCP |
Window Size | 65535 bytes | Max without window scaling |
Window Scale | 0-14 | Multiplier: 2^scale (RFC 7323) |
MSL | 2 minutes | Maximum Segment Lifetime |
TIME-WAIT | 2 * MSL | Typically 1-4 minutes |
Initial RTO | 1 second | Retransmission timeout |
keepalive time | 2 hours | Idle time before probe (if enabled) |
Well-Known Ports 0-1023 Reserved
| Port | Service | Description |
|---|
20 | FTP Data | File Transfer Protocol (data) |
21 | FTP Control | File Transfer Protocol (control) |
22 | SSH | Secure Shell |
23 | Telnet | Unencrypted text communications |
25 | SMTP | Simple Mail Transfer Protocol |
53 | DNS | Domain Name System (also UDP) |
80 | HTTP | Hypertext Transfer Protocol |
110 | POP3 | Post Office Protocol v3 |
143 | IMAP | Internet Message Access Protocol |
443 | HTTPS | HTTP over TLS/SSL |
587 | SMTP | Mail submission (with auth) |
993 | IMAPS | IMAP over TLS |
3306 | MySQL | MySQL database |
5432 | PostgreSQL | PostgreSQL database |
Common Options Variable Length
| Kind | Length | Option | Purpose |
|---|
0 | 1 | End of Options | Marks end of options list |
1 | 1 | No-Op | Padding for alignment |
2 | 4 | MSS | Maximum Segment Size |
3 | 3 | Window Scale | Window scaling factor (RFC 7323) |
4 | 2 | SACK Permitted | Selective ACK allowed |
5 | var | SACK | Selective ACK blocks |
8 | 10 | Timestamps | RTT measurement, PAWS (RFC 7323) |