http://www.inetdaemon.com/tutorials/internet/tcp/data_transfer.shtml
Transmission Control Protocol is a Transport Layerhost-to-host protocol that provides reliable,connection-oriented communication over IPnetworks.
- Transmission Control Protocol Characteristics
- Transmission Control Protocol Operation
- TCP Segmentation
- TCP Connection Establishment
- Synchronization
- 3-Way Handshake
- TCP Reliable Transmission
- TCP Connection Teardown
- TCP Reassembly
- Transmission Control Protocol Packet Structure
- TCP Header
- Payload Carries Upper Layer Protocols
Once the three-way handshake completes and connection is established, TCP signals the Application Layer to begin data transfer and communication. TCP handles that data transfer as follows:
- TCP breaks up messages from applications using protocols like HTTP, SMTP and POP3 (email) and FTP into segments.
- TCP then transmits the segments (message pieces) to the remote hosts
- TCP on the remote host reassembles the segments even if they are received out of order.
TCP segments the Application Layer data, lables the data and passes the data down the protocol stack to the Network, Data Link and Physical layers.
Because the host receiving TCP segments always sends ACKnowledgements to the sender, TCP always knows the state of the connection.
TCP provides for the recovery of segments that get lost, are damaged, duplicated or received out of their correct order. TCP is described as a 'reliable' protocol because it attempts to recover from these errors.
The sequencing is handled by labling every segment with a sequence number. These sequence numbers permit TCP to detect dropped segments. TCP also requires that an acknowledge message be returned after transmitting data.
To verify that the segments are not damaged, a CRC check is performed on every segment that is sent, and every segment that is received. Because every packet has a time to live field, and that field is decremented during each forwarding cycle, TCP must re-calculate the CRC value for the segment at each hop. Segments that do not match the CRC check are discarded.
The Transmission Control Protocol (TCP) header is the first 24 bytes of a TCP segment that contains the parameters and state of an end-to-end TCP socket. The TCP header is used to track the state of communication between two TCP endpoints. Since TCP segments are inserted (encapsulated) in the payload of the IP packet the TCP header immediately follows the IP header during transmission. TCP does not need to keep track of which systems are communicating, it only needs to track which end to end sockets are currently open. Internet Protocol handles the logical addressing, routing and host-to-host connectivity.
TCP uses port numbers on each side of the connection to track the connection endpoints, state bits such as SYN, ACK, RST, FIN, sequence numbers and acknowledgement numbers to track the communication at each step in transmission.
An example of a TCP header is shown below.
| Source Port (0 - 65535) |
Destination Port |
||||||||
| Sequence Number (0 - 4294967295) |
|||||||||
| Acknowledgement Number (0 - 4294967295) |
|||||||||
| Data Offset |
Reserved | U R G |
A C K |
P S H |
R S T |
S Y N |
F I N |
Window | |
| Checksum (CRC-Check) |
Urgent Pointer | ||||||||
| Options | Padding | ||||||||
| Data | |||||||||
| Field | Bits | Usage |
| Source Port | 16 | Communication source point |
| Destination Port | 16 | Communication end point |
| Sequence Number | 32 | Used for segmentation and reassembly of TCP segments. |
| Data Offset | Indicates number of bytes into segment where data can be found (number of bytes in the TCP header) | |
| Reserved | ||
| URG - Urgent Flag |
1 |
|
| ACK - Acknowledgement Flag | 1 | Used during 3-way handshake and data transfers. |
| PSH - Push Flag | 1 | Used for TCP data push |
| RST - Reset Flag | 1 | Used to reset a TCP connection |
| SYN - Synchronize Flag | 1 | Used during 3-way handshake |
| FIN - End of data | 1 | Indicates end of the TCP session |
| Window | 16 | Number of octets in the TCP header |
| Checksum | 16 | |
| Urgent Pointer | 16 | |
| Options | Varies | |
| Padding | Varies |
The TCP three-way handshake in Transmission Control Protocol (also called the TCP-handshake; three message handshake and/or SYN-SYN-ACK) is the method used by TCP set up a TCP/IP connection over an Internet Protocol based network. TCP's three way handshaking technique is often referred to as "SYN-SYN-ACK" (or more accurately SYN, SYN-ACK, ACK) because there are three messages transmitted by TCP to negotiate and start a TCP session between two computers. The TCP handshaking mechanism is designed so that two computers attempting to communicate can negotiate the parameters of the network TCP socket connection before transmitting data such as SSH and HTTP web browser requests.
This 3-way handshake process is also designed so that both ends can initiate and negotiate separate TCP socket connections at the same time. Being able to negotiate multiple TCP socket connections in both directions at the same time allows a single physical network interface, such as ethernet, to be multiplexed to transfer multiple streams of TCP data simultaneously.
TCP 3-Way Handshake Diagram
Below is a (very) simplified diagram of the TCP 3-way handshake process. Have a look at the diagram on the right as you examine the list of events on the left.
| EVENT | DIAGRAM |
|
Host A sends a TCP SYNchronize packet to Host B Host B receives A's SYN Host B sends a SYNchronize-ACKnowledgement Host A receives B's SYN-ACK Host A sends ACKnowledge Host B receives ACK. |
 TCP Three Way Handshake (SYN,SYN-ACK,ACK) |
SYNchronize and ACKnowledge messages are indicated by a either the SYN bit, or the ACK bit inside the TCP header, and the SYN-ACK message has both the SYN and the ACK bits turned on (set to 1) in the TCP header.
TCP knows whether the network TCP socket connection is opening, synchronizing, established by using the SYNchronize and ACKnowledge messages when establishing a network TCP socket connection.
When the communication between two computers ends, another 3-way communication is performed to tear down the TCP socket connection. This setup and teardown of a TCP socket connection is part of what qualifies TCP a reliable protocol. TCP also acknowledges that data is successfully received and guarantees the data is reassenbled in the correct order.
Note that UDP is connectionless. That means UDP doesn't establish connections as TCP does, so UDP does not perform this 3-way handshake and for this reason, it is referred to as an unreliable protocol. That doesn't mean UDP can't transfer data, it just doesn't negotiate how the conneciton will work, UDP just transmits and hopes for the best.
Protocols Encapsulated in TCP
Note that FTP, Telnet, HTTP, HTTPS, SMTP, POP3, IMAP, SSH and any other protocol that rides over TCP also has a three way handshake performed as connection is opened. HTTP web requests, SMTP emails, FTP file transfers all manage the messages they each send. TCP handles the transmission of those messages.
TCP 'rides' on top of Internet Protocol (IP) in the protocol stack, which is why the combined pair of Internet protocols is called TCP/IP (TCP over IP). TCP segments are passed inside the payload section of the IP packets. IP handles IP addressing and routing and gets the packets from one place to another, but TCP manages the actual communication sockets between endpoints (computers at either end of the network or internet connection).
RELATED TUTORIALS
- More Tutorials about Transmission Control Protocol (TCP)
- More Tutorials about Internet Protocol (IP)
- More Tutorials about User Datagram Protocol (UDP)
TCP functions by opening connections to a remote computer. This is called connection-oriented communication. TCP maintains status information regarding the connections it makes and is therefore a reliable protocol. A single TCP connection is identified by combination of IP addresses and virtual port numbers used by both ends. During communication, additional numbers are used to keep track of the order or sequence in which the data segments are transmitted. The sequence numberindicates what order the segments of data should be reassembled. Finally, a maximum transmission size is constantly being negotiated via a fallback mechanism called windowing. The combination of port numbers, sequence numbers and window sizes constitutes a connection, or pipe.
For example, when you use your browser to open a website you are opening a TCP connection from your browser to the website. Your local computer uses an IP addresses and a virtual port number ot identify itself. Your computer opens a connection to the server on port 80 (the well-known port for HTTP, the protocol web pages are delivered on.
To establish a connection, TCP uses the three-way handshake (SYN-SYN-ACK). This three-way handshake will only be completed in one direction even if both sides initialize TCP socket connections at the same time.
TCP Sockets (or virtual ports) are used in TCP (and UDP) communication to identify unique end-to-end connections. They are called 'virtual ports' because a single physical connector can serve multiple connections. Each side of a socket connection uses its own port number, which does not change during the life of that connection. The port number and IP address together uniquely identify an endpoint. Together, two endpoints are considered a 'socket'.
Client-Server Pairings
All TCP and UDP communication has a source and destination, so there is always a source port and a destination port used for every socket connection.
A pair of fields within the TCP and UDP headers is used to track the source and destination Virtual Port Numbers used for that socket connection. Each field in the header is sixteen bits wide, so the value in the field can range from 0 - 65534. Each computer host uses a unique IP address, and also uses a unique source and destination port pairings to identify that specific connection between the two computers. Typically, when your computer connects to a website, it connects to the destination website on port 80 (the default port for HTTP / web traffic). A different source port on the local host is used. At one time, this port number was the next number above 1024 that wasn't already in use for another connection. For example, the first website connection would be set up on the source port of 1025 and the second connection on 1026. If the 1025 port is no longer needed and is closed, and another port is needed, then 1025 would be used.
Today, to defeat hackers, computer systems are choosing the source port at random as hackers can predict this behavior and hijack sessions by predicting new connections being opened.
Servers run network services and these services are bound to a virtual port and listen for communication on that virtual port. It is possible for multiple clients to connect to the same service and thus, use the same destination port number when connecting to the server. Because each client uses a unique IP address and port number, the server can keep track of up to 65534 connections per host.
However, whether the port number is the source, or the destination port depends on which side is currently transmitting information. The client and server asynchronously transmit and receiving information using these ports.
TCP Segmentation
Segmentation is the process of carving up information into smaller pieces. The documentation for Transmission Control Protocol (TCP) refrers to what it calls 'data streams'. A data stream is really nothing more than a series of zeroes and ones that represent information. TCP receives data from an application and segments the data into pieces. This segmentation is necessary so that the information can be placed inside the TCP data field.
Once the data is segmented it is encapsulated within TCP. The TCP segment and TCP header is then passed down to Internet Protocol which stuffs the TCP segment and header into the payload of the IP datagram.
By segmenting the data, TCP creates chunks of data that can be routed separately over whatever connections are needed in order to reach the destination. Any of these segments can be retransmitted to replace the original segmentst that got lost or damaged in transmission.
TCP Reassembly
TCP reassembles segments into a data stream and feeds that data stream to the application. The best known example of this activity is HTTP transfer of a web page. The web server loads a web page from disk, encapsulates the web page text in HTTP headers, the passes the HTTP encoded stream of text to TCP. TCP segments the text stream for transport across the network. The networking software (the stack) receives the TCP data segments and reassembles the HTTP stream of text, which your web browser reads, and renders as a web page.
TCP Flow control
Flow control is the process of managing the rate at which data is transmitted. Using flow control, a computer receiving data can signal that it is not ready to receive data. TCP provides a flow control mechanism using acknowlegements of TCP sequence numbers.
TCP Sliding Window Mechanism
All segments of data transmitted via TCP are assigned sequence numbers when they are inserted into the TCP packet. When the receiving computer sends an acknowledgement, the acknowledgement will include the next sequence number it is ready to receive.
TCP Multiplexing
Multiplexing is the process of combining two or more data streams into a single physical connection. TCP provides multiplexing facilities by using source and destination port numbers. These port numbers allow TCP to set up a number of virtual connections over a physical connnection and multiplex the data stream through that connection.
Typically, a transmitting host will attempt to connect to a well-known port number at the destination host. A few examples of 'well known ports' of protocols that ride on top of TCP are:
25 - Simple Mail Transport Protocol (SMTP)
21 - File Transfer Protocol
22 - Secure Shell
23 - Telnet
80 - HTTP
443 - HTTPS
The transmitting station will use a source port that is some arbitrary number above 1023. Each source and destination port pairing identifies a separate virtual connection, allowing multiple connections to share one physical network connection.
Practical Example
- Launch your web browser
- Type in a web page address
- The browser opens a connection to download the web page at that address.
- The browser opens a second connection for an image in that web page.
- The browser opens a third connection for the external style sheet for that page.
- Each of the three connections uses a different set of virtual ports.
- The web page, the image and the stylesheet all download simultaneously.
- The page is rendered by your browser.
TCP Precedence - The Priority Bits
The three highest order bits in the Type of Service field are set aside for Priority. The priority function is provided to allow TCP to mark certain packets as higher priority. Packets with higher priority will get forwarded first. In addition, a provision is made to allow for compression and encryption of the TCP headers. All of these functions are signalled by a set of flags in the TCP header.
