TechKnowSurge
Cisco CCNA 1.5 CompTIA A+ Core 1 2.1 Cisco CCST Cybersecurity 2.1 Cisco CCST Networking 1.5 Cisco CyberOps Associate 4.8
VideoNetworkFree

TCP

TCP is a connection-oriented transport layer protocol that ensures reliable data delivery through sequencing, acknowledgements, retransmission, and flow control. This content covers how TCP establishes connections, segments and reassembles data, and manages congestion, along with an introduction to the TCP header.

Complete this video to capture a CTF flag worth 1 point.

About this video

TCP is the predominant transport layer protocol in modern networking because it provides the reliability that most application-layer communication requires. Unlike UDP, which sacrifices reliability for speed, TCP establishes a formal connection between two devices before any data is exchanged. This connection is built using sockets, each defined by an IP address and a port number, which together identify both the endpoint and the specific session. A single device can maintain multiple simultaneous connections to the same destination, distinguished by unique source port numbers, making it possible to have several browser tabs open to the same website without confusion between data streams. Once a connection is established, TCP breaks large data transfers into smaller segments and assigns each one a sequence number at Layer 4. The receiving device uses these sequence numbers to reassemble the segments into the correct order, regardless of how they arrive. As segments are received, the destination device sends acknowledgements back to the sender indicating the sequence number of the next expected segment. If a segment is missing, the acknowledgement reflects that gap, and the sender retransmits the missing data, ensuring that nothing is permanently lost in transit. TCP also includes mechanisms to prevent network congestion and receiver overload. Through a process called windowing, the sender limits how much unacknowledged data can be in flight at any given time, using the pace of incoming acknowledgements as a signal of how much the network and receiving device can handle. When acknowledgements are delayed, data transmission slows accordingly. Segment size can also be adjusted dynamically to match network conditions, preventing the kind of compounding bottlenecks that occur when too much data floods a constrained path. The protocols that depend on TCP, including HTTP, HTTPS, SSH, FTP, SMTP, IMAP, and POP, rely on it precisely because confirmed, ordered delivery matters for their function. All of the behaviors described above are coordinated through fields in the TCP header, which contains source and destination ports, sequence and acknowledgement numbers, and additional control information. The TCP header is the central data structure through which connection management, sequencing, acknowledgement, and flow control are all implemented and tracked.

What you'll learn

What's covered

TCP Overview

Aligned to

Cisco CCNA
1.5 Compare TCP to UDP
CompTIA A+ Core 1
2.1 Compare and contrast Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports, protocols, and their purposes.
Cisco CCST Cybersecurity
2.1 Describe TCP/IP protocol vulnerabilities
Cisco CCST Networking
1.5 Describe common network applications and protocols
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis

Key terms

Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
User Datagram Protocol
UDP
A connectionless transport protocol that sends data without establishing a connection or guaranteeing delivery.
Transport Layer
Layer 4 of the OSI model, responsible for end-to-end communication, flow control, and error recovery.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Segment
A unit of data at the TCP transport layer, created by breaking larger data into smaller chunks for transmission and reassembly.
Acknowledgement
ACK
A signal sent by a receiving device to confirm that a segment has been received, and to indicate the next expected sequence number.
Flow Control
A protocol function that manages the rate of data transmission between devices to prevent overwhelming the receiver.
Congestion Control
A TCP mechanism that adjusts the rate of data transmission in response to network congestion to prevent packet loss and degradation.
Windowing
A flow control technique in TCP that controls how much data can be sent before an acknowledgement is required from the receiver.
Three-Way Handshake
The TCP process of establishing a connection using three steps — SYN, SYN-ACK, and ACK — to synchronize communication between two devices.

Transcript

As we were looking at the different protocols, you probably noticed that a good portion of those were TCP. That's because we want a certain amount of reliability that TCP has to offer. So although UDP has its place, TCP is really crucial to a lot of the communication that we have.

Connections

One thing that's pretty cool about TCP is it establishes connections. As this device right here, which is at 10404 15, is establishing communication with 172.16.43, it establishes a connection between the two. This happens on layer 4, and it happens with TCP, where this device is establishing a connection with the server over here.

We know that session consists of a couple of different sockets. There's the socket on this machine, where let's say it's accessing some sort of web page. And on this machine over here it's going to come up with some ephemeral port. So 2151, let's say, is the port that it's establishing this connection on. Then this is what's used to figure out what IP address, or excuse me, what service it's going to access: the IP address that that packet needs to go to, and the port or service that it needs to access.

This is going to establish what conversation this is. The source socket is going to establish the IP address of where it's going, plus the conversation. So if you have multiple browsers that are open to this same website, then it's going to track that by its source port, and realize that the source port will be, for instance, different tabs that are open on that machine.

So that's the connection. It's going to establish this connection and the parameters as it communicates back and forth. There are some reasons why we establish that connection: what I want and what I'm going to do, what I'm going to ask for, what information. So I'd like to establish a connection with you, and then it does this little handshake to establish a connection between these two devices so we can communicate across these devices.

Sequencing, segmentation and reassembly

Then we have some sort of sequencing that happens, and this is crucial for segmentation and for the reassembly of it. We need to sequence our packets as we send them across, and we do this in layer 4. Layer 4 is what specifies the sequence number.

As we said, if we're downloading a five gigabyte file, we don't take up this full connection from one device to another just to download that 5 gigabytes, taking up the connection where no one else can communicate and causing problems. If there was ever any disruption in that, then we'd have to start that download all over again. Instead, we break this into smaller components, or segments, and send it across in smaller chunks. That gives opportunity for other devices to come in and do their communication at the same time.

So this is where segmentation and reassembly come in: we have to sequence these messages that are being sent across. I'm just going to use a simple example of one, two, three, four for now. That's not really how it's done, but just for this purpose right here I'm just going to label them one, two, three, four. As the packets come across to the other side, this device right here is going to be opening those up and realizing, well, this is the first information. It's going to look in that layer 4 and say, this is the first data, this is the second piece of data, this is the third, this is the fourth. I'm going to reassemble that. Now I've got the complete data, all of the data that I need.

Acknowledgements, reliability and retransmission

Now, what happens with this is that there's some sort of acknowledgement. As this data is coming over to this side, there's acknowledgement that happens that this device sends back, and says this is the data that I've received so far. There are several purposes for this acknowledgement. It does some congestion control, it does some windowing, something called windowing. But one crucial part to this is that it leads into our reliability and retransmission of data if something is missing.

As an example of this, let's say I'm going to once again use the simple numbering of 1, 2, 3, 4 as we go through this, and then packet three is lost along the way. Segment three is lost somewhere along the way, and for some reason it doesn't get to its final destination. What happens is that this computer on the other side will send an acknowledgement, and the acknowledgement is going to be of what it's expecting next.

We'll get more into sequencing and acknowledgement numbers and what they look like, but in this example right here, it's going to acknowledge what it's received by sending what is the next thing I'm expecting. This acknowledgement right here is that it's already received packet one and packet two. So in this example right here, what is the next piece of data that it expects to receive? That is packet three. So the acknowledgement in my scenario right here would be, I'm acknowledging the next packet that I'm expecting to receive is three.

Then this device sees the acknowledgement of three and realizes that it didn't receive packet three, and maybe packet four as well. So it will resend packet three and packet four, so that way this device will get packet three and packet four. In which case it will then send another acknowledgement after it receives those and say, okay, the next I'm expecting to receive is packet five.

That's how communication happens, how acknowledgement happens, and how things get retransmitted if there's a piece of data that's missing.

Flow control and congestion control

One thing that can happen along the way is that there could be a device that is slower than the rest of the devices, or this machine itself could only take on so much as it's communicating back and forth. So there needs to be a mechanism. If this device just keeps sending data and there's some sort of congestion along the way, or that device is not ready for the next set of data, what can happen is those points get overwhelmed and then they tend to break down in how they work.

It's kind of like a traffic jam on the freeway. Traffic can be running really smoothly, but then once it topples over and hits a certain point and more cars just end up getting onto the freeway, it just compounds the issue and causes a lot of issues. So somehow we need to meter how much information is coming from one machine to the next. As it experiences issues, it needs a way to compensate for that.

TCP does that. TCP has a mechanism to allow these devices to be able to do some windowing and make some other adjustments. The simple way of doing this is just with those acknowledgements: I'm only going to send so much data until I receive acknowledgement back. If there's a delay with this machine acknowledging back to the other machine that's receiving this information, if there's a delay in that acknowledgement, then there's going to be a delay in sending more data. So that's one way that we can help with this process and not have this area where there's stuff getting backed up, or where this machine's not ready for that data yet.

So the acknowledgement alone is one of the solutions for this, but then there are also some things that we can do with the segment size. Adjusting the segment size means that as data is going over there, that size can vary depending on what that network is able to handle as it sends that across.

Protocols that use TCP

We saw that there were a lot of protocols: HTTP, HTTPS, SSH, Telnet, FTP, SMTP, IMAP, POP. A lot of these different protocols will use TCP, because generally if we make a request, we want to see it through. We want to see it happen. When we request a web page, we want to get that. That's why TCP is used for a lot of different things.

But there are times, when we're talking on the phone, that if we were to get a few missing pieces here and there, that's not as important as making sure we get most of the conversation. And when we're talking about missing pieces, we're talking about really small pieces that are really going to go unnoticed when we're on a conversation. So UDP is used for some stuff. It has a specific reason, but really TCP is used for a lot of these protocols.

The TCP header

Here's the TCP header. There are some interesting fields in here, such as the source port and destination port, and we've already talked a little bit about ports. We've talked about sequence numbers and the acknowledgements. We're going to get more in depth into what each one of these components are in future sessions, so I'm not going to go too in depth into this, but this at least gets you an initial glimpse into the TCP header.

Recap

There you have it, the TCP header. And we talked about several other components to TCP. It really fulfills a lot of its duties in pretty amazing ways. It's pretty fascinating the way these sequence numbers and acknowledgement numbers happen back and forth. This was a brief overview of TCP, and in the following modules we'll actually get more into the details of how it does that and what that looks like.

We talked about connections, and that TCP establishes those connections. It also segments that data and has some sort of sequence to that data so it can reassemble it on the other side. There are acknowledgements that happen along the way that allow for us to do some traffic flow control, some of the flow of traffic, and control some congestion aspects to it. We also talked about sequencing from a reliability and a retransmission standpoint, that the acknowledgements will help facilitate retransmitting data if that's what needs to happen. We also talked about services associated with TCP and how TCP works. And then finally we wrapped it up with the TCP header and what the TCP header looks like. So a lot of amazing things are happening within this TCP header.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →