Transmission Control Protocol
obsoleted by
- rfc-9293 — Transmission Control Protocol (TCP)
obsoletes
- rfc-761 — DoD standard Transmission Control Protocol
updated by
Extracted elements (28)
SYN and FIN flags are given implicit sequence numbers so they can be retransmitted and acknowledged exactly once without confusion, ensuring connection setup and teardown signals are reliably delivered. Physical data space is not consumed; the sequence number accounting is purely implicit.
The 32-bit sequence space was sized to make wandering duplicate segments harmless: at 2 Mbps the cycle time is 4.5 hours, vastly exceeding the expected maximum segment lifetime of tens of seconds. Even at 100 Mbps the cycle is 5.4 minutes, deemed acceptable for foreseeable networks.
The clock-based ISN generator was chosen so that new ISNs are always larger than sequence numbers used in any prior connection incarnation that could still have segments in the network. If a TCP retains sequence number memory across a restart, it need not wait the quiet time but must use larger sequence numbers.
The robustness principle 'be conservative in what you do, be liberal in what you accept from others' is the guiding design philosophy for TCP implementations, intended to promote interoperability across diverse and potentially faulty network environments.
The three-way handshake is necessary to prevent old duplicate connection initiations from causing confusion. Because sequence numbers are not tied to a global clock and TCPs may use different ISN mechanisms, the receiver of the first SYN cannot determine whether it is a delayed old duplicate without a confirmation exchange.
TIME-WAIT is required to last at least 2×MSL (2 × 2 minutes) so the remote TCP can receive the final ACK to its FIN; without this delay, a new connection incarnation on the same socket pair could receive a delayed FIN from the old incarnation and be erroneously closed.
A passive OPEN with an unspecified foreign socket (all zeros) accepts connections from any caller. When multiple passive OPENs share the same local socket, an active OPEN is matched first to a TCB with a specific matching foreign socket before considering TCBs with unspecified foreign sockets.
A reset (RST) must be sent whenever a segment arrives apparently not intended for the current connection. In CLOSED state, any incoming segment except a RST elicits a RST. In non-synchronized states, an unacceptable ACK or security mismatch elicits a RST. A RST must not be sent if it is unclear the segment is misdirected.
A segment is acceptable only if it overlaps the receive window: RCV.NXT ≤ SEG.SEQ < RCV.NXT+RCV.WND or RCV.NXT ≤ SEG.SEQ+SEG.LEN-1 < RCV.NXT+RCV.WND. Zero-length segments with zero window require SEG.SEQ = RCV.NXT. Even with a zero receive window, a TCP must process RST and URG fields of all incoming segments.
A TCP must implement all defined options. The Maximum Segment Size option must only be sent in the initial connection request segment (one with the SYN control bit set); if absent, any segment size is permitted.
After a crash in which memory of sequence numbers in use was lost, a TCP must keep quiet for a maximum segment lifetime (MSL = 2 minutes) before emitting any segments, to allow old segments from prior incarnations to drain from the network.
Connection establishment must use a three-way handshake: the initiator sends SYN, the responder replies with SYN-ACK, and the initiator completes with ACK. Simultaneous active OPENs from both sides are also handled correctly through this mechanism.
In synchronized states (ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT), any unacceptable segment must elicit only an empty ACK segment and the connection remains in the same state. A security, compartment, or precedence mismatch in a synchronized state must send a RST and close the connection.
RST segments must be validated by checking that their sequence number falls within the receive window before acting on them, except in SYN-SENT state where the RST is acceptable if the ACK field acknowledges the SYN. An invalid RST must be ignored.
TCP modules operating in a multilevel secure environment must mark outgoing segments with the correct security classification, compartment, and precedence, and must provide higher-level protocols an interface to specify desired security levels for each connection.
TCP provides flow control via a window field in every ACK, indicating the number of octets the receiver is currently prepared to accept starting from the acknowledgment number. The sender must not transmit beyond the window boundary without further permission.
The initial sequence number (ISN) must be selected from a clock-based generator whose low-order bit increments approximately every 4 microseconds, cycling every ~4.55 hours. Since the Maximum Segment Lifetime (MSL) is taken to be 2 minutes (well under 4.55 hours), ISNs will be unique across connection incarnations.
Upon transmitting a segment, TCP places a copy on the retransmission queue and starts a timer. If an acknowledgment is not received before the timer expires, the segment must be retransmitted. Damage is handled by checksumming each segment and discarding damaged ones at the receiver.
When the push function is signaled by the sending user, the TCP must promptly transmit all data collected to that point. When a receiving TCP sees the PUSH flag, it must not wait for more data from the sending TCP before passing data to the receiving process.
A socket is formed by concatenating an internet address with a 16-bit port identifier, creating a unique endpoint address across all connected networks. A connection is uniquely identified by a pair of sockets (local and foreign); a single socket may participate in multiple simultaneous connections.
The sequence number space is 32-bit (0 to 2^32 - 1) with all arithmetic performed modulo 2^32. SYN and FIN control flags each implicitly consume one sequence number so they can be retransmitted and acknowledged. An ACK of sequence number X confirms receipt of all octets up to but not including X.
The Transmission Control Block (TCB) stores all per-connection state: local and remote socket numbers, security and precedence, buffer pointers, retransmit queue pointer, and sequence variables SND.UNA, SND.NXT, SND.WND, SND.UP, SND.WL1, SND.WL2, ISS, RCV.NXT, RCV.WND, RCV.UP, and IRS.
TCP provides per-connection precedence and security using the IP type-of-service and security fields. Incoming segments whose security level, compartment, or precedence does not exactly match the connection's parameters must cause a RST and connection abort, preventing cross-domain data leakage.
A TCP connection progresses through eleven states: CLOSED, LISTEN, SYN-SENT, SYN-RECEIVED, ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, and TIME-WAIT. Transitions are triggered by user calls (OPEN, SEND, RECEIVE, CLOSE, ABORT), incoming segment flags (SYN, ACK, RST, FIN), and timeouts.
Connection closing uses a FIN exchange: the initiating side sends FIN and enters FIN-WAIT-1; on receiving ACK it enters FIN-WAIT-2; on receiving FIN it sends ACK and enters TIME-WAIT; after a 2-MSL timeout it transitions to CLOSED. The passive side transitions ESTABLISHED → CLOSE-WAIT → LAST-ACK → CLOSED after sending its own FIN.
The Maximum Segment Size option (Kind=2, Length=4) carries a 16-bit value communicating the sender's maximum receive segment size. TCP options are variable-length, must be a multiple of 8 bits, and use a two-format scheme: single-octet (kind only) or multi-octet (kind, length, data).
The TCP checksum is a 16-bit one's complement of the one's complement sum of all 16-bit words in the header and data, computed over a 96-bit pseudo-header prepended to the TCP segment containing Source Address, Destination Address, Protocol, and TCP Length. This protects against misrouted segments.
The TCP header contains: Source Port (16 bits), Destination Port (16 bits), Sequence Number (32 bits), Acknowledgment Number (32 bits), Data Offset (4 bits), Reserved (6 bits), Control Bits URG/ACK/PSH/RST/SYN/FIN (6 bits), Window (16 bits), Checksum (16 bits), Urgent Pointer (16 bits), followed by variable-length Options padded to a 32-bit boundary.