TCP

Protocols & Transport Security Notes Jan 6, 2025 BASH

Definition

When you send a message over the internet, how does it actually get there reliably? How does the receiving computer know if some data got lost along the way? TCP (Transmission Control Protocol) is the answer - it is the foundational protocol that guarantees your data arrives complete, in order, and without corruption, even when traveling across dozens of networks spanning continents.

Think of the internet like a postal system where letters can arrive out of order, duplicated, or not at all. TCP fixes all of this. Before sending any data, it establishes a connection using a “three-way handshake” - both sides confirm they are ready to communicate. Then it breaks your data into packets, numbers them sequentially, sends them out, waits for acknowledgments, and retransmits anything that got lost. The receiving end reassembles everything in the correct order and confirms receipt.

This reliability comes at a cost: overhead. The handshakes, acknowledgments, and retransmissions take time. For web browsing, where you absolutely need every byte of a page to load correctly, this trade-off is worth it. HTTP/1.1 and HTTP/2 both run on top of TCP for this reason. However, for applications like video streaming or gaming where occasional lost packets are acceptable and speed matters more, protocols like UDP (or the newer QUIC) might be better choices.

Example

Every website you visit: When your browser loads a webpage, TCP ensures every HTML tag, every CSS rule, every JavaScript function arrives correctly. One missing byte could break the entire page, so TCP’s reliability is essential.

Email transmission: When you send an email, SMTP uses TCP to guarantee your message arrives intact. You would not want half your email to disappear because some packets were lost.

File downloads: When you download a file, TCP ensures every byte arrives correctly. A corrupted file is useless, so the reliability overhead is completely justified.

SSH connections: When you connect to a server via SSH, TCP maintains your session and ensures your commands and their responses are delivered reliably.

Analogy

The Registered Mail with Tracking: TCP is like sending a package via registered mail with tracking and delivery confirmation. The postal service confirms each step of the journey, delivers items in order, and will redeliver if something goes wrong. You pay more in time and effort, but you have guarantees.

The Phone Conversation: When you have a phone call, there is an initial connection (dial, ring, answer - the handshake), then a continuous reliable channel. If you miss something, you ask them to repeat it (retransmission). You both know when the conversation ends. TCP mirrors this conversational model.

The Assembly Line Verification: Imagine an assembly line where each part is numbered and verified. If part #7 is missing or damaged, the line stops until it is fixed or replaced. Parts are assembled in order, and the final product is verified complete. TCP applies this quality control to data transmission.

The Jigsaw Puzzle by Mail: Imagine mailing a jigsaw puzzle where each piece is sent separately. You number each piece, the recipient confirms which pieces arrived, and you resend any missing ones. Once all pieces arrive, they can assemble the complete picture. TCP does this with data packets.

Diagram

sequenceDiagram
    participant C as Client
    participant S as Server

    rect rgb(200, 230, 200)
        Note over C,S: 3-Way Handshake (Connection Setup)
        C->>S: SYN (seq=100)
        S->>C: SYN-ACK (seq=300, ack=101)
        C->>S: ACK (seq=101, ack=301)
    end

    rect rgb(200, 220, 240)
        Note over C,S: Data Transfer with ACKs
        C->>S: Data (seq=101, 500 bytes)
        S->>C: ACK (ack=601)
        C->>S: Data (seq=601, 500 bytes)
        S->>C: ACK (ack=1101)
        S->>C: Data (seq=301, 200 bytes)
        C->>S: ACK (ack=501)
    end

    rect rgb(240, 200, 200)
        Note over C,S: 4-Way Teardown (Connection Close)
        C->>S: FIN (seq=1101)
        S->>C: ACK (ack=1102)
        S->>C: FIN (seq=501)
        C->>S: ACK (ack=502)
    end

Code Example


# View TCP connection with netstat
netstat -an | grep ESTABLISHED

# Output shows TCP connections
tcp4  0  0  192.168.1.100.51234  93.184.216.34.443  ESTABLISHED

# TCP three-way handshake
Client β†’ Server: SYN (sequence=1000)
Server β†’ Client: SYN-ACK (sequence=5000, ack=1001)
Client β†’ Server: ACK (sequence=1001, ack=5001)
# Connection established

Security Notes

SECURITY NOTES

CRITICAL: TCP is transport layer. APIs use TCP via HTTP/HTTPS. Security at application layer.

TCP Characteristics:

  • Connection-oriented: Establishes connection first
  • Reliable: Guaranteed delivery, ordered
  • Flow control: Prevents sender overwhelming receiver
  • Error detection: Detects corrupted packets
  • Sequence numbers: Ensures packets in order

Security Limitations:

  • No encryption: TCP data visible on network
  • No authentication: No verification of sender
  • Vulnerable to: MITM attacks, packet sniffing, hijacking
  • Use TLS: Always use TLS/SSL on top of TCP

TCP Vulnerabilities:

  • SYN flood: Attacker floods with SYN packets
  • TCP reset: Attacker resets connection
  • Sequence guessing: Guess sequence number to inject data
  • Connection hijacking: Inject packets into connection
  • Eavesdropping: Capture unencrypted data

API Usage:

  • Port 80: HTTP (unencrypted, deprecated)
  • Port 443: HTTPS (encrypted with TLS)
  • Firewall: Control TCP access via firewall
  • Proxy: Can proxy TCP connections

Best Practices:

  • Use TLS: Always encrypt TCP with TLS
  • HTTPS only: Use HTTPS for APIs
  • Firewall rules: Restrict TCP access
  • Connection limits: Limit concurrent TCP connections
  • Timeout: Close idle connections

Standards & RFCs