|
|
|
The TCP Packet: The following figure shows the various fields inside the TCP header. We will briefly
describe each of these fields and their purpose.

Flags: 1 bit each. These are used as control and error detection and correction mechanisms.
URG: indicates that the Urgent Pointer sent in the packet is valid.
SYN: Synchronize sequence number, set when initiating a connection.
ACK: indicates that the ACK number sent in the packet is valid.
RST: Used to reset a connection.
FIN: Used to terminate a connection.
PSH: used to indicate that the data has to be delivered to the application immediately and not to be
buffered.
Sequence Number and Acknowledgement number: 32 bits. The sequence number and the acknowledgment number allows the TCP stack at both ends to determine whether or not all the packets have been received. Not all packets travel through the same route and in the same order. The sequence number facilitates the reassembly of packets at the receiving end. Based on the sequence number, TCP can easily decide if any of the packets are missing and can request for retransmission by sending a negative acknowledgement. Only the missing packet will be retransmitted.
The sequence number field either contains the sequence number of the first byte of data in that particular segment or the Initial Sequence Number (ISN) that identifies the first byte of data that will be sent when a new connection is established.
The process can be easily explained with the help of the following diagram.

To initiate a connection Client Machine A sends to Host Server B a segment with the SYN flag set and a ISN (ISN=A in the figure). Host B responds to A with a segment that has both SYN and ACK flag bits set. It also informs A which sequence number (SQN) it will start with (ISN=B). Finally A sends a last segment with the ACK bit set before transmitting the actual data. Thus it can be seen that the Acknowledgement number is actually the host's sequence number +1 and is used to indicate the successful receipt of the last sent segment. After completing the data transfer the 2 machines in a similar fashion will exchange a 3-way handshake using the FIN flag bit to close the connection.
The SQN's are randomly generated numbers within the guidelines provided by RFC 793. (See Predicting TCP Sequence Numbers for
understanding how they are generated).
Source Port and Destination Port: 16 bits.
Window size: 16 bits.
This indicates to the receiver the maximum size of the data that the sender can receive.
Checksum: 16 bit.
This number is a one's complement of the one's complement of the sum of all the bytes in the tcp header including the data bytes which may be padded with 0's to form a 16-bit word. It is used for error detection. It does not perform error correction.
Urgent Pointer: 16-bit.
It indicates a number which is a positive offset from the sequence number for this particular segment. If the URG flag is set then this field points to the sequence number of the last byte in a sequence of urgent data.
Padding: It is used to ensure that the TCP header ends and the data begins on a 32 bit boundary, if not 0's are padded.
Reserved: 6 bits. Reserved for future use.
Data Offset: 4 bits.
It indicates the number of 32-bit words in the TCP header. This indicates the beginning of the data section.
Options: Variable length.
Options occupy space at the end of the TCP header. All options are included in the checksum. It has two formats.
- A single octet of option kind.
- Three octets, one each for option kind, option length and option data.
One commonly used option is maximum segment size option used by the sender and the receiver to agree
upon the maximum size of a segment. This prevents a machine from sending large segments to another
machine incapable of handling large segments due to fewer resources.
|
Computer Security Home
The OSI and the TCP/IP Layers
TCP
IP
Network & Application Layer Attacks
Network Layer DoS
Syn Flood
Ack Flood
RESET Attack
FIN Attack
Teardrop Attack
IP Spoofing
Predicting TCP Sequence Numbers
Application Layer Attacks
Buffer Overflows
Trojans
Backdoors
Cross-site Scripting
CGI abuses
Firewalls
Packet Filters
Proxy Firewalls
Circuit Level Proxies
Application Level Proxies
Stateful Inspection Firewalls
Limitations of Firewalls
Intrusion Detection and Prevention Systems
Signature Based
Anomaly Based
Statistical Anomaly Based
Protocol Anomaly Based
Host Based IDS (HIDS)
Network Based IDS (NIDS)
Protocol Anomaly Based NIDS
Signature Based NIDS
Web Application Firewalls
Vulnerability Assesment
Host Based Scanner
Network Based Scanner
Web Application Vulnerability Scanner
Content Filters
Encryption
Conclusion
|
|