TCP Recap

calendar Sep 26, 2026 · 6 min read · networking tcp/ip  ·
Share on: linkedin copy

One idea per line, in the order a connection lives through them. A read more link points at the RFC section behind a line; RFC 9293 is today's TCP specification. The TCP Simulator shows most of these lines happening.

The basic units: segment, connection, stream

  • Segment: a TCP header plus the data it carries, sent inside one IP packet.
  • Connection: identified by four values: source IP, source port, destination IP, destination port.
  • Byte stream: TCP numbers bytes, not segments; the application reads a stream with no message boundaries.
  • Reliable, in order: every byte is acknowledged, resent if lost, and handed to the application in sequence.
  • Header: 20 bytes without options, up to 60 with them. Read more
  • MSS (maximum segment size): the most data one segment carries, announced in the SYN; 1460 bytes on Ethernet (1500 − 20 IP − 20 TCP). Read more

The flags

  • SYN: opens a connection and carries the initial sequence number.
  • ACK: the acknowledgment number is valid; set on nearly every segment after the first SYN.
  • FIN: the sender has no more data to send; the other direction stays open.
  • RST: abort the connection now.
  • PSH: the end of an application write: the receiver should pass the data up at once.
  • URG: the urgent pointer is valid; almost never used today. Read more
  • ECE, CWR: congestion signals from ECN, a router marking packets instead of dropping them. Read more

Sequence numbers

  • Sequence number: the number of the segment's first data byte.
  • ISN (initial sequence number): the first number a side uses; each side picks its own.
  • Random ISN: stops a segment from an old connection on the same ports, or one an attacker guesses, from landing inside the new connection's window. Read more
  • SYN and FIN take one number each, although they carry no data, so that they can be acknowledged.
  • Pure ACK: a segment with no data, SYN or FIN takes no number, so nothing ever acknowledges it.
  • Wrap-around: the number is 32 bits and wraps to 0 after 4 GiB; fast links add timestamps to tell laps apart. Read more
  • Relative numbers: Wireshark shows seq and ack counted from each side's ISN; the packets carry the real ones.

Opening a connection

  • Three-way handshake: SYN, SYN-ACK, ACK. Read more
  • Why three segments: each side must send its ISN and see it acknowledged; the middle segment does both.
  • LISTEN: a server's socket waits for SYNs on its port.
  • Connection refused: a SYN to a port nobody listens on is answered with RST.
  • Lost SYN: the client resends it after a timeout, doubling the wait each time.
  • Simultaneous open: two SYNs cross; both sides answer with SYN-ACK. Rare, but legal.
  • SYN flood: fake SYNs fill the server's table of half-open connections; SYN cookies keep no state until the final ACK. Read more
  • TCP Fast Open: data on the SYN, for a client that has connected to this server before. Read more

Sending data and acknowledging it

  • Acknowledgment number: the next byte the receiver expects; everything before it has arrived.
  • Cumulative ACK: one ACK covers every segment below its number.
  • Piggybacking: an ACK rides on data going the other way, so it costs no segment of its own.
  • Delayed ACK: the receiver waits a little, always less than half a second, and acknowledges at least every second full segment. Read more
  • Write versus segment: one large write becomes several segments; several small writes may share one.
  • Nagle's algorithm: holds small writes back while earlier data is unacknowledged. Read more

Flow control: the receive window

  • Receive window: how many more bytes the receiver has room for; sent on every segment.
  • The sender's limit: bytes sent and not yet acknowledged may not exceed the window.
  • Zero window: the receiver is full; the sender probes until it opens again. Read more
  • Window scale: the field is 16 bits (64 KiB); an option in the SYN multiplies it for fast links. Read more
  • Congestion window: the sender's own limit, guessed from loss; it sends the smaller of the two. Read more

Loss and retransmission

  • Retransmission timeout (RTO): resend when no ACK arrives in time; the timer follows the measured round-trip time. Read more
  • Out of order: the receiver holds segments past a gap, and its ACK keeps naming the missing byte.
  • Duplicate ACK: an ACK repeating the previous number, a sign that something past a gap arrived.
  • Fast retransmit: three duplicate ACKs trigger a resend without waiting for the timer. Read more
  • SACK: an option listing the blocks received past a gap, so only the missing ones are resent. Read more
  • Karn's rule: an ACK for a resent segment gives no round-trip sample: it may answer either copy. Read more

Closing a connection

  • FIN closes one direction only: the side that sent it may still receive. Read more
  • Four segments: FIN, ACK, FIN, ACK; the middle two often travel as one FIN-ACK. Read more
  • FIN_WAIT_1, FIN_WAIT_2: the closing side waits for its FIN's ACK, then for the other side's FIN.
  • CLOSE_WAIT: the other side has closed and this side's application has not yet.
  • Stuck in CLOSE_WAIT: the application never closed its socket: a bug in the program, not in TCP.
  • LAST_ACK: the second side has sent its FIN and waits for the final ACK.
  • CLOSING: both FINs crossed; each side waits for the ACK of its own.

TIME_WAIT

  • Who waits: the side that closed first, after sending the last ACK.
  • Why: to resend that ACK if it was lost, and to let stray segments of the connection die out before the same four values are used again. Read more
  • How long: twice the maximum segment lifetime (2×MSL); the RFC's MSL is 2 minutes, Linux waits 60 seconds in all.
  • Many TIME_WAITs: normal on a busy client that opens many short connections; each one holds a local port for that time.

Resetting a connection

  • Reset: a RST ends the connection at once: no handshake, no TIME_WAIT, unsent data discarded.
  • Who sends one: a host that gets a segment for a connection it does not have, or an application that aborts. Read more
  • Nothing acknowledges a RST.
  • A RST counts only at the exact expected sequence number; one elsewhere in the window gets a challenge ACK, against forged resets. Read more
  • Half-open connection: one side crashed and forgot it; the other learns when its next segment is answered with RST. Read more

Idle connections

  • An idle connection sends nothing: TCP has no heartbeat unless one is turned on.
  • Keepalive: an optional probe after a long idle time, at least two hours by default. Read more
  • NAT and firewalls forget idle connections much sooner, which is why applications send their own keepalives. See the NAT Overload Simulator .

The state machine

  • Eleven states, from CLOSED through LISTEN, SYN_SENT, SYN_RECEIVED and ESTABLISHED to the closing ones above. Read more
  • ss -tan (or netstat -tan) lists every connection on a Linux host with its state.