2 cissp ® Official Study Guide Eighth Edition

1.
The client sends a SYN (synchronize) flagged packet to the server.
2.
The server responds with a SYN/ACK (synchronize and acknowledge) flagged packet 
back to the client.
3.
The client responds with an ACK (acknowledge) flagged packet back to the server.
F I g u r e 11. 7
The TCP three-way handshake
C
SYN/ACK
SYN
ACK
S

---

TCP/IP Model 
455
When a communication session is complete, there are two methods to disconnect the 
TCP session. First, and most common, is the use of FIN (finish) flagged packets instead of 
SYN flagged packets. Each side of a conversation will transmit a FIN flagged packet once 
all of its data is transmitted, triggering the opposing side to confirm with an ACK flagged 
packet. Thus, it takes four packets to gracefully tear down a TCP session. Second is the use 
of an RST (reset) flagged packet, which causes an immediate and abrupt session termina-
tion. (Please see the discussion of the TCP header flag later in this section.)
The segments of a TCP transmission are tagged with a sequence number. This allows 
the receiver to rebuild the original communication by reordering received segments back 
into their proper arrangement in spite of the order in which they were received. Data com-
municated through a TCP session is periodically verified with an acknowledgment. The 
acknowledgment is sent by the receiver back to the sender by setting the TCP header’s 
acknowledgment sequence value to the last sequence number received from the sender 
within the transmission window. The number of packets transmitted before an acknowl-
edge packet is sent is known as the transmission window. Data flow is controlled through a 
mechanism called sliding windows. TCP is able to use different sizes of windows (in other 
words, a different number of transmitted packets) before sending an acknowledgment. 
Larger windows allow for faster data transmission, but they should be used only on reli-
able connections where lost or corrupted data is minimal. Smaller windows should be used 
when the communication connection is unreliable. TCP should be employed when the deliv-
ery of data is required. Sliding windows allow this size to vary dynamically because the 
reliability of the TCP session changes while in use. In the event that all packets of a trans-
mission window were not received, no acknowledgment is sent. After a timeout period, the 
sender will resend the entire transmission window set of packets again.
The TCP header is relatively complex when compared to the other common Transport 
layer protocol, UDP. A TCP header is 20 to 60 bytes long. This header is divided into sev-
eral sections, or fields, as detailed in Table 11.1.
TA b l e 11.1
TCP header construction (ordered from beginning of header to end)