1. Connection Establishment and Termination

2. Tcpdump tcpdump is a common packet analyzer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. For TCP segments, each output line begins with Source>destination:flags Flags represents four of the six flag bits. S,F,R,P,.(none of these four flags is on)

4. 4 Timeline

5. Establishing a TCP Connection The 3-way handshake – Guarantee that both sides are ready for connection – Allows both sides to agree on initial sequence numbers Receive SYN Site 1NetworkSite 2 Send SYN seq=x Send SYN seq=y, ACK x+1 Send ACK y+1 Receive SYN&ACK Receive ACK

6. Three-way handshake

7. The side that sends the first SYN is said to perform an active open; The other side, which receives this SYN and sends the next SYN, performs a passive open. ISN (Initial sequence number) It takes 3 segments to establish a connection

8. Closing a TCP Connection Applications should close a connection when they have no more data to transmit Connection can be closed in either one or both directions – Site 1 finishes transmitting data and waits for ACK from site 2 – Site 1 transmits a segment with the FIN bit set – Site 2 acknowledges the FIN segment – Site 2 notifies the application that no more data is coming – Data can still be transmitted from site 2 to site 1 – Site 1 will still receive and acknowledge data from site 2 – Eventually, site 2 will finish transmitting and close its connection – Both endpoints delete record of the connection

9. It takes four segments to terminate a connection TCP’s half-close TCP connection –full duplex(Each direction must be shut down independently) The end that issues the close performs the active close And the other end (that receives this FIN) performs the passive close (quit command is used)

10. Closing a TCP Connection (cont) Site 1NetworkSite 2 Send FIN seq=x Receive FIN Send ACK x+1 Receive FIN&ACK Receive ACK Send FIN seq=y, ACK x+1 Send ACK y+1 Receive ACK (app closes connection) (inform application) (app closes connection) FIN Ack of FIN FIN Ack of FIN

11. Each end of the data flow must be shut down independently (“half-close”) If one end is done it sends a FIN segment. This means that no more data will be sent Four steps involved: (1) X sends a FIN to Y (active close) (2) Y ACKs the FIN, (at this time: Y can still send data to X) (3) and Y sends a FIN to X (passive close) (4) X ACKs the FIN.

12. 12 Connection termination-Half close Server Client FIN M ACK M+1 FIN N ACK N+1 Active close segment 1 Half close Passive close segment 2 data Segment 4 Segment 3

13. Half Closed Connection One end of connection (e.g. client  server) terminates (sends FIN and receives ACK of FIN) Other end (server  client) remains open (sending data) Other end (server) later terminates (sends FIN and receives ACK of FIN), and connection is then completely closed

14. TCP’s half close

15. Simultaneous open Segments exchanged during simultaneous open A connects with B, B connects with A at same time (pass each other in the network) – Only one connection will be established! – Using only 2 ports (one on A, one on B)

16. 16 Simultaneous Close A sends FIN to B, B sends FIN to A at same time (pass each other in the network) FIN_WAIT_1 CLOSING TIME_WAIT FIN_WAIT_1 CLOSING TIME_WAIT FIN J FIN K Ack K+1 Ack J+1 AB

17. Connection Reset A connection can also be aborted with a RST segment (hard reset) – normally reserved for error conditions, not normal termination