TCP is a connection-oriented transport layer protocol that ensures reliable data delivery through sequencing, acknowledgements, retransmission, and flow control. This content covers how TCP establishes connections, segments and reassembles data, and manages congestion, along with an introduction to the TCP header.
TCP Overview
As we were looking at the different protocols, you probably noticed that a good portion of those were TCP. That's because we want a certain amount of reliability that TCP has to offer. So although UDP has its place, TCP is really crucial to a lot of the communication that we have.
One thing that's pretty cool about TCP is it establishes connections. As this device right here, which is at 10404 15, is establishing communication with 172.16.43, it establishes a connection between the two. This happens on layer 4, and it happens with TCP, where this device is establishing a connection with the server over here.
We know that session consists of a couple of different sockets. There's the socket on this machine, where let's say it's accessing some sort of web page. And on this machine over here it's going to come up with some ephemeral port. So 2151, let's say, is the port that it's establishing this connection on. Then this is what's used to figure out what IP address, or excuse me, what service it's going to access: the IP address that that packet needs to go to, and the port or service that it needs to access.
This is going to establish what conversation this is. The source socket is going to establish the IP address of where it's going, plus the conversation. So if you have multiple browsers that are open to this same website, then it's going to track that by its source port, and realize that the source port will be, for instance, different tabs that are open on that machine.
So that's the connection. It's going to establish this connection and the parameters as it communicates back and forth. There are some reasons why we establish that connection: what I want and what I'm going to do, what I'm going to ask for, what information. So I'd like to establish a connection with you, and then it does this little handshake to establish a connection between these two devices so we can communicate across these devices.
Then we have some sort of sequencing that happens, and this is crucial for segmentation and for the reassembly of it. We need to sequence our packets as we send them across, and we do this in layer 4. Layer 4 is what specifies the sequence number.
As we said, if we're downloading a five gigabyte file, we don't take up this full connection from one device to another just to download that 5 gigabytes, taking up the connection where no one else can communicate and causing problems. If there was ever any disruption in that, then we'd have to start that download all over again. Instead, we break this into smaller components, or segments, and send it across in smaller chunks. That gives opportunity for other devices to come in and do their communication at the same time.
So this is where segmentation and reassembly come in: we have to sequence these messages that are being sent across. I'm just going to use a simple example of one, two, three, four for now. That's not really how it's done, but just for this purpose right here I'm just going to label them one, two, three, four. As the packets come across to the other side, this device right here is going to be opening those up and realizing, well, this is the first information. It's going to look in that layer 4 and say, this is the first data, this is the second piece of data, this is the third, this is the fourth. I'm going to reassemble that. Now I've got the complete data, all of the data that I need.
Now, what happens with this is that there's some sort of acknowledgement. As this data is coming over to this side, there's acknowledgement that happens that this device sends back, and says this is the data that I've received so far. There are several purposes for this acknowledgement. It does some congestion control, it does some windowing, something called windowing. But one crucial part to this is that it leads into our reliability and retransmission of data if something is missing.
As an example of this, let's say I'm going to once again use the simple numbering of 1, 2, 3, 4 as we go through this, and then packet three is lost along the way. Segment three is lost somewhere along the way, and for some reason it doesn't get to its final destination. What happens is that this computer on the other side will send an acknowledgement, and the acknowledgement is going to be of what it's expecting next.
We'll get more into sequencing and acknowledgement numbers and what they look like, but in this example right here, it's going to acknowledge what it's received by sending what is the next thing I'm expecting. This acknowledgement right here is that it's already received packet one and packet two. So in this example right here, what is the next piece of data that it expects to receive? That is packet three. So the acknowledgement in my scenario right here would be, I'm acknowledging the next packet that I'm expecting to receive is three.
Then this device sees the acknowledgement of three and realizes that it didn't receive packet three, and maybe packet four as well. So it will resend packet three and packet four, so that way this device will get packet three and packet four. In which case it will then send another acknowledgement after it receives those and say, okay, the next I'm expecting to receive is packet five.
That's how communication happens, how acknowledgement happens, and how things get retransmitted if there's a piece of data that's missing.
One thing that can happen along the way is that there could be a device that is slower than the rest of the devices, or this machine itself could only take on so much as it's communicating back and forth. So there needs to be a mechanism. If this device just keeps sending data and there's some sort of congestion along the way, or that device is not ready for the next set of data, what can happen is those points get overwhelmed and then they tend to break down in how they work.
It's kind of like a traffic jam on the freeway. Traffic can be running really smoothly, but then once it topples over and hits a certain point and more cars just end up getting onto the freeway, it just compounds the issue and causes a lot of issues. So somehow we need to meter how much information is coming from one machine to the next. As it experiences issues, it needs a way to compensate for that.
TCP does that. TCP has a mechanism to allow these devices to be able to do some windowing and make some other adjustments. The simple way of doing this is just with those acknowledgements: I'm only going to send so much data until I receive acknowledgement back. If there's a delay with this machine acknowledging back to the other machine that's receiving this information, if there's a delay in that acknowledgement, then there's going to be a delay in sending more data. So that's one way that we can help with this process and not have this area where there's stuff getting backed up, or where this machine's not ready for that data yet.
So the acknowledgement alone is one of the solutions for this, but then there are also some things that we can do with the segment size. Adjusting the segment size means that as data is going over there, that size can vary depending on what that network is able to handle as it sends that across.
We saw that there were a lot of protocols: HTTP, HTTPS, SSH, Telnet, FTP, SMTP, IMAP, POP. A lot of these different protocols will use TCP, because generally if we make a request, we want to see it through. We want to see it happen. When we request a web page, we want to get that. That's why TCP is used for a lot of different things.
But there are times, when we're talking on the phone, that if we were to get a few missing pieces here and there, that's not as important as making sure we get most of the conversation. And when we're talking about missing pieces, we're talking about really small pieces that are really going to go unnoticed when we're on a conversation. So UDP is used for some stuff. It has a specific reason, but really TCP is used for a lot of these protocols.
Here's the TCP header. There are some interesting fields in here, such as the source port and destination port, and we've already talked a little bit about ports. We've talked about sequence numbers and the acknowledgements. We're going to get more in depth into what each one of these components are in future sessions, so I'm not going to go too in depth into this, but this at least gets you an initial glimpse into the TCP header.
There you have it, the TCP header. And we talked about several other components to TCP. It really fulfills a lot of its duties in pretty amazing ways. It's pretty fascinating the way these sequence numbers and acknowledgement numbers happen back and forth. This was a brief overview of TCP, and in the following modules we'll actually get more into the details of how it does that and what that looks like.
We talked about connections, and that TCP establishes those connections. It also segments that data and has some sort of sequence to that data so it can reassemble it on the other side. There are acknowledgements that happen along the way that allow for us to do some traffic flow control, some of the flow of traffic, and control some congestion aspects to it. We also talked about sequencing from a reliability and a retransmission standpoint, that the acknowledgements will help facilitate retransmitting data if that's what needs to happen. We also talked about services associated with TCP and how TCP works. And then finally we wrapped it up with the TCP header and what the TCP header looks like. So a lot of amazing things are happening within this TCP header.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →