TCP Handshake NW Analysis Class

What happens in 3-way handshake Client tells server it wants connection Server acknowledges the client’s connection Server tells the client it wants connection Client acknowledges the servers connection Agree in initialize synchronization numbers Agree and initialize options to use

TCP Header Format | Source Port | Destination Port | | Sequence Number | | Acknowledgment Number | | Data | |C|E|U|A|P|R|S|F| | | Offset| Rsrvd |W|C|R|C|S|S|Y|I| Window | | | |R|E|G|K|H|T|N|N| | | Checksum | Urgent Pointer | | Options | Padding | | Data

SYN from Client | | 80 | | | | 0 | | 11 | 0 |0|0|0|0|0|0|1|0| | | | 0 | | 2 | 4 | 1460 | | 1 | 3 | 3 | 3 | | 1 | 1 | 8 | 10 | | | | 0 | | 4 | 2 | 0 | 0 |

SYN/ACK from Server | 80 | | | | | | | 10 | 0 |0|0|0|1|0|0|1|0| 5792 | | | 0 | | 2 | 4 | 1460 | | 4 | 2 | 8 | 10 | | | | | | 1 | 3 | 3 | 2 |

ACK from Client | | 80 | | | | | | 8 | 0 |0|0|0|1|0|0|0|0| | | | 0 | | 1 | 1 | 8 | 10 | | | | |

Port Numbers Service Ports Coordinated via IANA – IANA = Internet Assigned Numbers Authority – – Well Known: 0 to 1023 – Registered: 1024 to – Dynamic/Private: to Outgoing Ports … Ephemeral Ports – Some OS start at 102[45]-4999 or

Sequence Number Selection Depends on OS, used for OS detection even Most OS has changed for better randomization – Why? What are they used for? – Flow Control – Retransmissions – Length of Payload …well… everything TCP!

Maximum Segment Size (MSS) Defined in RFC793 (of course!) Option 2, 4b length, 0? – – How to decide what MSS should be? – MTU? Why important? – Path MTU Discovery, problems? Only Present in SYN What happens if not present in SYN

Window Scaling Defined in RFC1323 (performance!) Option 3, 3b, … – 0 = could do WS, but you seem not to – 1-14 = numbers of right-shift bits – 15? Reserved? No idea! 14=1GB max perhaps. Both sides have to support to use Affects (R)eceive and (S)end Windows Increases performance, how? Bad when?

Time Stamps Defined in RFC1323 (Performance!?!?) Option 8, 10b, , Establishes Round Trip Time Measurement – Why? Packet loss? When to send an ACK? Protects against SEQ Wraps

Selective Acknowledgement (SACK) Defined in RFC2018 In SYN: Option 4, 2b Length In ACKs: Option 5, Nb Length, min 10b – Why 10b minimum? – What is the max Length? – Why 3 block (24b) max? – Where the other 16b of Options go?

TCP Seldom (to me) Seen Partial Order Connection 9, 10 CC - 11, 12, 13 TCP Alternate Checksum – 14, 15 ….. There are a bunch of them; MDF, Bubba? Skeeter? I’ve got no idea. If you see them in the wild, I’d love to hear about it!