The three-way handshake and four-way wave process of TCP protocol

1. TCP/IP protocol suite

TCP/IP is a protocol family, usually developed in different layers, each layer is responsible for different communication functions. It includes the following four layers:

Link layer:

Also known as the data link layer or network interface layer, it usually includes the device driver in the operating system and the corresponding network interface card in the computer. Together, they handle the details of the physical interface with the cable (or any other transmission medium).

Network layer:

Also known as the Internet layer, it handles the activities of packets in the network, such as packet routing. Network layer protocols include IP (Internet Protocol), ICMP (Internet Control Message Protocol), and IGMP (Internet Group Management Protocol).

The transport layer mainly provides end-to-end communication between applications on two hosts:

There are two different transport protocols: TCP (Transmission Control Protocol) and UDP (User Datagram Protocol). TCP provides highly reliable data communication between two hosts. Its work includes breaking the data given to it by the application into appropriate small pieces and handing them to the network layer below, confirming the received packets, setting the timeout clock for sending the last confirmation packet, etc. Since the transport layer provides highly reliable end-to-end communication, the application layer can ignore all these details. On the other hand, UDP provides a very simple service to the application layer. It just sends packets called datagrams from one host to another, but it does not guarantee that the datagram will reach the other end. Any necessary reliability must be provided by the application layer.

The application layer is responsible for handling application-specific details:

Including Telnet (remote login), FTP (File Transfer Protocol), SMTP (Simple Mail Transfer Protocol) and SNMP (Simple Network Management Protocol).

2. Introduction to TCP protocol

TCP is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. TCP packages user data into segments, starts a timer after sending, confirms the data received at the other end, reorders out-of-order data, and discards duplicate data.

The characteristics of TCP are:

1. TCP is a connection-oriented transport layer protocol
2. Each TCP connection can only have two endpoints, and each TCP connection can only be point-to-point
3. TCP provides reliable delivery services
4. TCP provides full-duplex communication. Data is transmitted independently in both directions. Therefore, each end of the connection must maintain the sequence number of the data transmitted in each direction.
5. Byte stream oriented. Byte stream oriented means: although the application and TCP interact one data block at a time, the data handed over by the TCP application is just a series of unstructured byte streams.

The TCP message header is shown in the following figure:

1. Source port number: the port number of the data initiator, 16 bits
2. Destination port number: the port number of the data receiver, 16 bits
3. Sequence number: 32-bit sequence number, used by the sender
4. Confirmation number: The 32-bit confirmation number is the sequence number of the next message segment that the data receiver expects to receive from the sender. Therefore, the confirmation number should be the sequence number of the last successfully received data byte plus 1.
5. Header length: The number of 32-bit words in the header, which can represent a header of 15*32bit=60 bytes. The general header length is 20 bytes.
6. Reserved: 6 bits, all 0
7. Urgent URG: When URG=1, it means that there is urgent data in the message segment and it should be transmitted as soon as possible.
8. Confirmation bit ACK: When ACK = 1, it means this is a confirmed TCP packet, and when the value is 0, it is not a confirmed packet.
9. Push bit PSH: When the sender's PSH=1, the receiver delivers it to the application process as soon as possible.
10. Reset bit (RST): When RST=1, it indicates that a serious error has occurred in the TCP connection and the connection must be released and then re-established.
11. Synchronization bit SYN: It is used to synchronize the sequence number when establishing a connection. SYN=1, ACK=0 indicates a connection request segment. SYN=1, ACK=1 indicates that the connection is agreed to be established.
12. Termination bit FIN: When FIN=1, it indicates that the sender of this message segment has sent all the data and requests to release the transmission connection.
13. Window: It is used to control the amount of data sent by the other party and to notify the release of the determined upper limit of the sending window.
14. Checksum: This field checks both the header and the data. It is calculated and stored by the sending end and verified by the receiving end.
15. Urgent pointer: The urgent pointer is valid only when URG=1, and it indicates the number of bytes of urgent data in this message segment.
16. Options: Variable length, up to 40 bytes.

3. Detailed explanation of the three-way handshake process

The so-called three-way handshake is to establish a TCP connection, which means that when establishing a TCP connection, the client and the server need to send a total of 3 packets to confirm the establishment of the connection. In socket programming, this process is triggered by the client executing connect. The whole process is shown in the figure below:

(1) First handshake:

The client sets the SYN flag to 1, randomly generates a value seq=J, and sends the data packet to the server. The client enters the SYN_SENT state and waits for confirmation from the server.

(2) Second handshake:

After receiving the data packet, the server knows from the flag bit SYN=1 that the client requests to establish a connection. The server sets the flag bits SYN and ACK to 1, ack=J+1, randomly generates a value seq=K, and sends the data packet to the client to confirm the connection request. The server enters the SYN_RCVD state.

(3) The third handshake:

After receiving the confirmation, the Client checks whether ack is J+1 and ACK is 1. If correct, the flag ACK is set to 1, ack=K+1, and the data packet is sent to the Server. The Server checks whether ack is K+1 and ACK is 1. If correct, the connection is successfully established, the Client and Server enter the ESTABLISHED state, and the three-way handshake is completed. Then the Client and Server can start transmitting data.

4. Detailed explanation of the four-wave process

The so-called Four-Way Wavehand, which terminates a TCP connection, means that when a TCP connection is disconnected, the client and the server need to send a total of 4 packets to confirm the disconnection. In socket programming, this process is triggered by either the client or the server executing close. The whole process is shown in the figure below:

Since TCP connection is full-duplex, each direction must be closed separately. The principle is that when one party completes the data sending task, it sends a FIN to terminate the connection in this direction. Receiving a FIN only means that there is no data flow in this direction, that is, no more data will be received, but data can still be sent on this TCP connection until FIN is sent in this direction. The party that closes first will perform an active close, while the other party will perform a passive close, as described in the figure above.

1st wave:

The client sends a FIN to close the data transmission from the client to the server, and the client enters the FIN_WAIT_1 state.

Second wave:

After receiving FIN, the server sends an ACK to the client, confirming that the sequence number is the received sequence number + 1 (the same as SYN, one FIN occupies one sequence number), and the server enters the CLOSE_WAIT state.

The third wave:

The server sends a FIN to close the data transmission from the server to the client, and the server enters the LAST_ACK state.

The fourth wave:

After the client receives the FIN, it enters the TIME_WAIT state, and then sends an ACK to the server, confirming that the sequence number is the received sequence number + 1. The server enters the CLOSED state, completing four waves.

Conclusion

Why is it that establishing a connection requires three handshakes, but closing the connection requires four handshakes?

This is because when the server is in the LISTEN state, after receiving the SYN message of the connection establishment request, it puts the ACK and SYN in one message and sends it to the client. When closing the connection, when receiving the other party's FIN message, it only means that the other party will no longer send data but can still receive data. The party may not have sent all the data to the other party, so the party can close immediately, or send some data to the other party, and then send a FIN message to the other party to indicate that it agrees to close the connection now. Therefore, the ACK and FIN of the party are generally sent separately.