Home | Computer Security | Fun | About Vikram Phatak | Contact
 


 

The TCP Packet: The following figure shows the various fields inside the TCP header. We will briefly describe each of these fields and their purpose.

TCP-Header.gif - 16501 Bytes

  Flags: 1 bit each. These are used as control and error detection and correction mechanisms.

    URG: indicates that the Urgent Pointer sent in the packet is valid.

    SYN: Synchronize sequence number, set when initiating a connection.

    ACK: indicates that the ACK number sent in the packet is valid.

    RST: Used to reset a connection.

    FIN: Used to terminate a connection.

    PSH: used to indicate that the data has to be delivered to the application immediately and not to be buffered.

Sequence Number and Acknowledgement number: 32 bits. The sequence number and the acknowledgment number allows the TCP stack at both ends to determine whether or not all the packets have been received. Not all packets travel through the same route and in the same order. The sequence number facilitates the reassembly of packets at the receiving end. Based on the sequence number, TCP can easily decide if any of the packets are missing and can request for retransmission by sending a negative acknowledgement. Only the missing packet will be retransmitted.

The sequence number field either contains the sequence number of the first byte of data in that particular segment or the Initial Sequence Number (ISN) that identifies the first byte of data that will be sent when a new connection is established.

The process can be easily explained with the help of the following diagram.

3-way-handshake.gif - 20389 Bytes


To initiate a connection Client Machine A sends to Host Server B a segment with the SYN flag set and a ISN (ISN=A in the figure). Host B responds to A with a segment that has both SYN and ACK flag bits set. It also informs A which sequence number (SQN) it will start with (ISN=B). Finally A sends a last segment with the ACK bit set before transmitting the actual data. Thus it can be seen that the Acknowledgement number is actually the host's sequence number +1 and is used to indicate the successful receipt of the last sent segment. After completing the data transfer the 2 machines in a similar fashion will exchange a 3-way handshake using the FIN flag bit to close the connection.

The SQN's are randomly generated numbers within the guidelines provided by RFC 793. (See Predicting TCP Sequence Numbers for understanding how they are generated).

Source Port and Destination Port: 16 bits.

Window size: 16 bits.
This indicates to the receiver the maximum size of the data that the sender can receive.

Checksum: 16 bit.
This number is a one's complement of the one's complement of the sum of all the bytes in the tcp header including the data bytes which may be padded with 0's to form a 16-bit word. It is used for error detection. It does not perform error correction.

Urgent Pointer: 16-bit.
It indicates a number which is a positive offset from the sequence number for this particular segment. If the URG flag is set then this field points to the sequence number of the last byte in a sequence of urgent data.

Padding: It is used to ensure that the TCP header ends and the data begins on a 32 bit boundary, if not 0's are padded.

Reserved: 6 bits. Reserved for future use.

Data Offset: 4 bits.
It indicates the number of 32-bit words in the TCP header. This indicates the beginning of the data section.

Options: Variable length.
Options occupy space at the end of the TCP header. All options are included in the checksum. It has two formats.

    - A single octet of option kind.
    - Three octets, one each for option kind, option length and option data.

One commonly used option is maximum segment size option used by the sender and the receiver to agree upon the maximum size of a segment. This prevents a machine from sending large segments to another machine incapable of handling large segments due to fewer resources.



Computer Security Home

The OSI and the TCP/IP Layers

TCP

IP

Network & Application Layer Attacks
    Network Layer DoS
        Syn Flood
        Ack Flood
        RESET Attack
        FIN Attack
        Teardrop Attack

    IP Spoofing
        Predicting TCP Sequence Numbers

    Application Layer Attacks
        Buffer Overflows
        Trojans
        Backdoors
        Cross-site Scripting
        CGI abuses

Firewalls
    Packet Filters
    Proxy Firewalls
        Circuit Level Proxies
        Application Level Proxies
    Stateful Inspection Firewalls
  Limitations of Firewalls

Intrusion Detection and Prevention Systems
    Signature Based
    Anomaly Based
        Statistical Anomaly Based
        Protocol Anomaly Based
    Host Based IDS (HIDS)
    Network Based IDS (NIDS)
        Protocol Anomaly Based NIDS
        Signature Based NIDS

Web Application Firewalls

Vulnerability Assesment
    Host Based Scanner
    Network Based Scanner
    Web Application Vulnerability Scanner

Content Filters

Encryption

Conclusion




Copyright © 2006 Vikram Phatak. All rights reserved.