📡 Tutorial 6: TCP Fundamentals and Segment Structure (Advanced)

University‑level treatment – COMP347 (TrustOpen University)

📘 1. TCP Overview and Service Model

TCP provides a connection‑oriented, reliable, full‑duplex byte‑stream service to applications. Key characteristics:

• Connection‑oriented: A logical connection is established before data exchange using a three‑way handshake.
• Reliable: Uses acknowledgments, sequence numbers, and retransmissions to recover from packet loss, corruption, and reordering.
• Ordered: Data is delivered to the application in the exact order it was sent.
• Full‑duplex: Data can flow in both directions simultaneously.
• Byte‑stream: TCP does not preserve message boundaries; it delivers a continuous stream of bytes.
• Flow control: Prevents sender from overwhelming receiver.
• Congestion control: Prevents network overload (covered in later tutorials).

TCP is defined in RFC 793 (1981) and has been extended by numerous RFCs (e.g., RFC 1323 for window scaling, RFC 2018 for SACK).

📘 2. TCP Segment Structure – Detailed Field Analysis

A TCP segment consists of a header (minimum 20 bytes, up to 60 bytes with options) followed by data. The header format is:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Acknowledgment Number                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Data |           |U|A|P|R|S|F|                               |
| Offset| Reserved  |R|C|S|S|Y|I|            Window             |
|       |           |G|K|H|T|N|N|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Checksum            |         Urgent Pointer        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options (if any)                           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             Data                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Source Port (16 bits): Port of the sending process.
• Destination Port (16 bits): Port of the receiving process.
• Sequence Number (32 bits): The byte number of the first data byte in this segment (if SYN flag set, then ISN).
• Acknowledgment Number (32 bits): The next byte expected from the other side (cumulative ACK).
• Data Offset (4 bits): Header length in 32‑bit words; minimum 5 (20 bytes).
• Reserved (3 bits): Must be zero.
• Flags (9 bits, but commonly 6 control bits):
  • NS (ECN‑nonce) – used for explicit congestion notification.
  • CWR (Congestion Window Reduced).
  • ECE (ECN Echo).
  • URG (Urgent pointer field is valid).
  • ACK (Acknowledgment field is valid).
  • PSH (Push function – deliver data to application immediately).
  • RST (Reset the connection).
  • SYN (Synchronize sequence numbers – used during connection setup).
  • FIN (No more data from sender – used during teardown).
• Window (16 bits): Advertised receive window size (rwnd) in bytes – flow control.
• Checksum (16 bits): Error detection over the TCP header, data, and a pseudo‑header (similar to UDP). Mandatory in TCP.
• Urgent Pointer (16 bits): Offset from sequence number to urgent data; used only with URG flag.
• Options (variable): Common options include MSS, Window Scaling, SACK, Timestamps, No‑Operation (NOP), and End‑of‑Option (EOL).

2.1 The Pseudo‑Header for Checksum

TCP, like UDP, uses a pseudo‑header containing source IP, destination IP, protocol (6 for TCP), and TCP length. This ensures that the checksum protects against misrouting.

2.2 Flags and Their Uses

• SYN: Synchronize sequence numbers during connection establishment.
• ACK: Indicates the Acknowledgment field is valid; set for almost all segments except the initial SYN.
• FIN: Used to close a connection.
• RST: Aborts the connection.
• PSH: Informs the receiver to push data to the application; rarely used.
• URG: Marks urgent data (obsolete).

📘 3. Sequence Numbers and Acknowledgment Numbers

TCP views data as a stream of bytes. Each byte is assigned a sequence number. The Sequence Number field in a segment is the number of the first byte in that segment. The Acknowledgment Number is the sequence number of the next byte expected by the receiver; all bytes up to this number minus one have been received.

Initial Sequence Number (ISN): Chosen randomly at connection setup to avoid sequence number prediction attacks and to prevent old segments from interfering with new connections. The ISN is exchanged via SYN and SYN‑ACK.

Cumulative ACK: An ACK for byte n acknowledges all bytes up to n-1.

Example: If sender sends 100 bytes with seq=1000, the receiver will ACK with acknowledgment number 1100.

📘 4. Round‑Trip Time (RTT) and Timeout Estimation

TCP sets a retransmission timeout (RTO) to detect packet loss. The RTO is based on measured RTT. TCP maintains:

• SampleRTT: Measured time from sending a segment until receiving an ACK for that segment (only for segments sent once, not retransmitted).
• EstimatedRTT: Smoothed RTT using exponential averaging: EstimatedRTT = (1 - α) * EstimatedRTT + α * SampleRTT, with α typically 0.125.
• DevRTT: Smoothed deviation: DevRTT = (1 - β) * DevRTT + β * |SampleRTT - EstimatedRTT|, with β typically 0.25.
• TimeoutInterval (RTO): TimeoutInterval = EstimatedRTT + 4 * DevRTT.

This provides a conservative timeout that adapts to network variability.

Karn’s algorithm: When a retransmission occurs, ignore SampleRTT for that segment; instead, double the RTO to avoid spurious retransmissions.

📘 5. TCP Reliable Data Transfer – Sender and Receiver Behaviour

TCP’s reliable data transfer is a hybrid of GBN and SR:

• Uses cumulative ACKs (like GBN).
• Sender maintains a sliding window limited by min(cwnd, rwnd).
• On timeout: retransmit the oldest unacknowledged segment, restart timer.
• On receipt of duplicate ACK (same ACK number repeated): a fast retransmit is triggered after 3 duplicate ACKs (similar to SR selective retransmission).
• Receiver: accepts out‑of‑order segments and buffers them, but only ACKs the last in‑order byte (cumulative).

Sender events:

• Data from application: if window allows, segment and send; if not, buffer.
• ACK receipt: if cumulative ACK acknowledges new data, advance send window; if duplicate ACK, increment duplicate ACK count and possibly fast retransmit.
• Timeout: retransmit oldest unacknowledged segment, restart timer.

Receiver events:

• On receipt of in‑order segment: deliver data, send cumulative ACK.
• On receipt of out‑of‑order segment: buffer, send duplicate ACK for last in‑order.
• On receipt of segment with missing data: send ACK for next expected.

📘 6. Flow Control: The Advertised Window (rwnd)

Flow control prevents the sender from overwhelming the receiver’s buffer. The receiver advertises a receive window (rwnd) in every ACK. The sender limits the amount of unacknowledged data to min(cwnd, rwnd). This is a pure end‑to‑end flow control mechanism.

Zero‑window: If rwnd = 0, the sender stops sending. To avoid deadlock, the sender periodically sends a zero‑window probe (a single byte) to check if the window has opened.

📘 7. TCP Buffering and Window Management

TCP uses a send buffer to store data sent but not yet acknowledged, and a receive buffer to store received but not yet read data. The advertised window is computed as: rwnd = receive buffer size - (last byte read - last byte received).

When the application reads data, the window opens, allowing the sender to send more.

📘 8. Advanced Topics: Nagle’s Algorithm, Delayed ACKs, Silly Window Syndrome

8.1 Nagle’s Algorithm

Described in RFC 896, Nagle’s algorithm reduces the number of small packets sent over the network. It works as follows: if there is unacknowledged data in flight, the sender buffers small outgoing segments until either an ACK arrives or the segment reaches the MSS. This helps avoid the small‑packet problem, which can degrade network efficiency.

For interactive applications (e.g., Telnet), Nagle’s algorithm can introduce latency; it can be disabled with the TCP_NODELAY socket option.

8.2 Delayed ACKs

To reduce the number of ACK packets, a receiver may delay sending an ACK for up to 500 ms, hoping to piggyback it on outgoing data. This can reduce overhead but may interfere with the sender’s RTT estimation and cause spurious retransmissions.

8.3 Silly Window Syndrome (SWS)

SWS occurs when a receiver advertises a tiny window (e.g., 1 byte) and the sender sends tiny segments, leading to inefficient use of the network. Both sides take measures:

• Receiver: should not advertise a window smaller than MSS or a certain threshold.
• Sender: should not send small segments (Nagle’s algorithm helps).

These mechanisms improve efficiency, especially for interactive traffic.

📘 9. TCP Options Overview

TCP options extend the header beyond 20 bytes. Common options include:

• MSS (Maximum Segment Size): Maximum payload size the sender can receive; set during handshake.
• Window Scaling (RFC 1323): Allows windows larger than 65535 bytes by scaling the advertised window.
• SACK (Selective Acknowledgment) (RFC 2018): Enables selective retransmission.
• Timestamps (RFC 1323): Used for RTT measurement and PAWS (Protection Against Wrapped Sequence numbers).
• NOP (No‑Operation): Padding option to align other options.
• EOL (End of Options): Marks the end of the options list.

📝 Quiz

Test your understanding with these 35 questions. Answers are hidden below each.

🛠️ Exercises

Apply your knowledge with these 20 exercises. Solutions are provided below each.

📚 Homework

These advanced problems require synthesis, research, and quantitative analysis. Sample answers are provided below.