TCP — header, connection (3-way handshake, 4-way termination)
WHY does TCP need a header + handshake at all?
WHAT TCP gives you: a stream of bytes that arrive in order, without loss, without duplication, with flow control and congestion control.
WHY it can't just send data: IP packets can be lost, reordered, or duplicated. To recover, the receiver must be able to say "I got bytes up to position X." That requires both sides to agree on where counting starts — the Initial Sequence Number (ISN). You cannot acknowledge byte #5 if you never agreed where byte #0 was. Hence a handshake must happen before any data.
HOW it numbers things: TCP numbers bytes, not packets. If the ISN is 1000 and you send 500 bytes, the next segment starts at sequence 1500.
The TCP Header
Key flags (the verbs of TCP)
- SYN — "let's synchronize sequence numbers" (only at setup).
- ACK — "the Ack field is valid; I'm acknowledging."
- FIN — "I have no more data to send" (closes my direction).
- RST — "reset / abort, something's wrong."
- PSH — "push this to the app now, don't buffer."
- URG — "urgent pointer is valid."
3-Way Handshake (connection setup)
Why ack = ISN + 1 and not ISN? The ACK number means "next byte I expect." SYN occupies one phantom sequence slot (so a lost SYN can itself be retransmitted reliably), so the next expected byte is .
4-Way Termination (connection teardown)
Common Mistakes (Steel-manned)
Active Recall
Recall Quick self-test (cover the answers!)
- Minimum / maximum TCP header size? → 20 / 60 bytes
- What does the ACK number field carry? → next byte expected
- Why ack = ISN+1? → SYN consumes one sequence number
- Why is teardown 4-way? → independent half-close per direction
- Who enters TIME_WAIT, and for how long? → active closer, 2·MSL
Recall Feynman: explain to a 12-year-old
Two friends want to pass notes reliably. First they agree "I'll start counting my notes from 1000, you start from 5000" — that's a quick three-message hello so nobody loses track (handshake). Each note says "this is my note #N" and "I've read up to your note #M." When they're done, each says a separate "I'm finished talking" and waits for an "okay" — that's four goodbye messages, because either friend might still have one last thing to say after the other's already done.
Connections
- IP — packet structure & routing (TCP rides inside IP packets)
- UDP — connectionless transport (contrast: no handshake, no reliability)
- Sliding Window & Flow Control (the Window field in action)
- TCP Congestion Control (cwnd, slow start — uses seq/ack)
- Sockets & Ports (source/dest port fields)
- Reliable Data Transfer Principles (sequence numbers, retransmission)
What is the minimum and maximum size of a TCP header?
What does the TCP Sequence Number field represent?
What does the TCP Acknowledgment Number field represent?
Why is the ACK in a SYN-ACK equal to the client's ISN + 1?
List the three segments of the TCP 3-way handshake.
Why does TCP setup need only 3 messages instead of 4?
List the four segments of TCP connection termination.
Why is teardown 4-way but setup 3-way?
What is TIME_WAIT and how long does it last?
Which side enters TIME_WAIT?
Does TCP number packets or bytes?
What do the SYN, FIN, and RST flags mean?
Why does TCP need both a sequence and an acknowledgment number in every segment?
Concept Map
Hinglish (regional understanding)
Intuition Hinglish mein samjho
Dekho, TCP ka kaam hai IP ke upar ek reliable, ordered byte-stream banana. IP packets kho sakte hain, ulte-seedhe aa sakte hain — to TCP har byte ko number deta hai (packet ko nahi, byte ko!). Lekin counting shuru kahan se ho? Isiliye data bhejne se pehle dono side apna ISN (Initial Sequence Number) ek dusre ko batate hain. Yehi hai 3-way handshake: SYN bheja (seq=1000), server ne SYN+ACK bheja (apna seq=5000, aur ack=1001 — kyunki SYN ek sequence number kha jata hai), phir client ne ACK kiya (ack=5001). Ab dono directions sync ho gayi, data flow shuru.
Connection band karne mein 4-way termination lagta hai, 3 nahi. Reason: setup mein server ka ACK aur uska SYN ek hi packet mein ghus jaate hain, lekin teardown mein har direction alag-alag band hoti hai (half-close). Client FIN bhejta hai "main done", server ACK karta hai — par server abhi bhi data bhej sakta hai! Jab server bhi done hota hai to apna FIN bhejta hai, client final ACK karta hai. Isiliye chaar messages: FIN, ACK, FIN, ACK.
Ek important point: jo side pehla FIN bhejta hai (active closer) wahi TIME_WAIT mein jaata hai, 2×MSL time tak. Kyun? Agar uska last ACK kho gaya to peer dobara FIN bhejega aur use re-ACK karna padega; aur purane duplicate packets bhi expire ho jayein taaki same port-pair safely reuse ho. Yaad rakho: ye role-based hai (client ya server jo bhi pehle close kare), machine-based nahi.
Exam tip: header ka minimum 20 bytes, maximum 60 bytes (Data Offset field 32-bit words mein header length deta hai, max 15×4=60). Aur ACK number ka matlab hamesha "next expected byte" hota hai — yeh confusion sabse zyada hoti hai, isko pakka kar lo.