Self-checkedTier 1 8 min readcn.tcp-basics

TCP: segments, handshake and teardown

What TCP provides (a reliable, ordered byte stream between two processes over unreliable IP), the segment header fields and flags, sequence numbers that count bytes and acknowledgement numbers that name the next byte expected, the maximum segment size, the three-way handshake (SYN and FIN each use one sequence number), data transfer, the four-segment connection close and the main states of the TCP state machine, and the wrap-around time of the 32-bit sequence numbers; the segment exchange is generated by a model of the protocol with 32-bit arithmetic and checked on random transfers.

Why it exists

IP delivers datagrams between hosts without promises: they may be lost, duplicated or reordered. Applications want to send a stream of bytes and get the same stream out at the other end, in order and without gaps, between a particular process on one host and a process on another. TCP (transmission control protocol) builds that service on top of IP. It adds connections, ports, reliability (acknowledgements and retransmission, as in sliding window protocols), flow control (TCP flow control) and congestion control (TCP congestion control).

Prerequisites

You need IP datagrams, the MTU and their headers (IPv4 header and fragmentation).

Precise definitions

TCP is connection-oriented (a connection is set up before data are sent), provides a full-duplex byte stream (data flow in both directions at once) and is point-to-point (exactly two endpoints). An endpoint is identified by an IP address and a port number (16 bits); a connection by the pair of endpoints (source IP, source port, destination IP, destination port).

The TCP segment. The data from the application are cut into segments; each has a header (20 bytes without options, up to 60 with) and is carried in an IP datagram. Header fields (quoted):

field	size	meaning
source port, destination port	16 bits each	identify the processes
sequence number	32 bits	number of the first data byte of the segment in the stream
acknowledgement number	32 bits	number of the next byte expected from the other side (valid if ACK is set)
header length	4 bits	in 4-byte words
flags	6 bits	URG, ACK, PSH, RST, SYN, FIN
window	16 bits	receive window (bytes the receiver is willing to accept: flow control)
checksum	16 bits	Internet checksum over header, data and a pseudo-header with the IP addresses
urgent pointer, options		for example the maximum segment size, window scale, timestamps

Sequence and acknowledgement numbers count bytes, not segments. If a segment carries bytes $s, s+1, \dots, s+n-1$ its sequence number is $s$ and the acknowledgement that confirms it has the number $s + n$ . The acknowledgement is cumulative: number $x$ means "all bytes up to $x - 1$ arrived". The numbers are 32 bits and wrap around modulo $2^{32}$ . The connection starts at an initial sequence number (ISN) chosen by each side (not $0$ , to avoid confusion with old connections).

The maximum segment size (MSS) is the largest number of data bytes in a segment. It is chosen so that the segment and the two headers fit in the MTU: $\text{MSS} = \text{MTU} - 20 - 20$ ( $1460$ for Ethernet), so that IP does not need to fragment.

How it works

The connection

A TCP connection: handshake, 1200 bytes up, 300 bytes down, close: start

Computed by a script, not typed

segment	direction	flags	sequence number	acknowledgement number	data bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

Step 0

Client initial sequence number 2000, server 8000, maximum segment size 500 bytes. Sequence numbers count BYTES; the acknowledgement number is the next byte expected.

0 / 15

computed by script: protocols are simulated slot by slot or round by round, sequence numbers use 32-bit arithmetic. python3 scripts/gen-cn4-traces.py

Three-way handshake (open). (1) The client sends a segment with SYN and its initial number ( $2000$ ). (2) The server replies with SYN+ACK: its own initial number ( $8000$ ) and acknowledgement $2001$ , because a SYN consumes one sequence number, so the next byte the server expects is $2001$ . (3) The client sends an ACK with acknowledgement $8001$ (the server's SYN also used a number); this segment may already carry data. Three segments are needed so that both sides know that the other has received and chosen its sequence numbers.

Data transfer. The client sends $1200$ bytes as segments of $500, 500, 200$ bytes with sequence numbers $2001, 2501, 3001$ ; the acknowledgements $2501, 3001, 3201$ show the cumulative next-byte-expected rule. The server's reply of $300$ bytes starts with sequence number $8001$ and is acknowledged with $8301$ . (Real TCP often acknowledges every second segment or delays the acknowledgement; this model acknowledges every segment.)

Closing. Each direction is closed separately, so closing takes four segments: the client's FIN (it consumes one sequence number: the client's next number is $3202$ ), the server's ACK $3202$ , the server's FIN (number $8301$ ) and the client's final ACK $8302$ . After the last ACK the client waits in the TIME_WAIT state for twice the maximum segment lifetime (quoted) in case the last ACK was lost. A side may also abort with a segment having the RST flag.

States (quoted from the textbooks)

state	meaning
CLOSED	no connection
LISTEN	server waits for a SYN
SYN_SENT	client has sent SYN
SYN_RCVD	server received SYN, sent SYN+ACK
ESTABLISHED	data transfer
FIN_WAIT_1 / FIN_WAIT_2	the side that closed first: FIN sent / its FIN acknowledged
CLOSE_WAIT	received FIN, application has not closed yet
LAST_ACK	the second side sent its FIN, waits for the ACK
TIME_WAIT	the side that closed first waits $2 \times$ MSL before CLOSED
CLOSING	both sides closed at the same time

Segment size

Maximum segment size from the MTU: start

Computed by a script, not typed

link	MSS (bytes)	segments for 100 000 bytes	data share of an Ethernet frame
MTU 1500
MTU 1280
MTU 576

Step 0

MSS = MTU - 20 (IP header) - 20 (TCP header, no options). Both headers at their minimum size.

0 / 3

computed by script: protocols are simulated slot by slot or round by round, sequence numbers use 32-bit arithmetic. python3 scripts/gen-cn4-traces.py

Wrap-around

Sequence numbers are 32 bits, so a sender that keeps a link full uses all numbers in $2^{32} \times 8 / R$ seconds:

Time for the 32-bit sequence numbers to wrap around: start

Computed by a script, not typed

link rate	wrap-around time	shorter than the 120 s segment lifetime
10 Mbps
100 Mbps
1 Gbps
10 Gbps

Step 0

Time = 2^32 bytes × 8 bits / rate. This is the reason for the timestamp option on fast links (quoted).

0 / 4

computed by script: protocols are simulated slot by slot or round by round, sequence numbers use 32-bit arithmetic. python3 scripts/gen-cn4-traces.py

On a $1$ Gbps link they wrap in $34.4$ s, less than the (conventional) maximum segment lifetime of $120$ s. A very old segment could then carry a sequence number that is valid again. At $10$ Mbps this takes almost an hour. This is why fast links need extra protection (the timestamp option).

Worked examples

EX 1Acknowledgement number

Easy

A segment carries $400$ bytes with sequence number $1000$ : the bytes $1000 \dots 1399$ . The acknowledgement that confirms it has number $1400$ . If the next segment ( $1400 \dots 1799$ ) is lost and the one after it ( $1800 \dots$ ) arrives, the receiver still acknowledges $1400$ (duplicate acknowledgement).

EX 2Handshake numbers

Medium

Client ISN $x$ , server ISN $y$ : SYN has seq $x$ ; SYN+ACK has seq $y$ , ack $x + 1$ ; the third segment has seq $x + 1$ , ack $y + 1$ ; the first data byte of the client has number $x + 1$ and of the server $y + 1$ . After $n$ bytes from the client and a FIN the client's next number is $x + 1 + n + 1$ .

EX 3Segments and MSS

Medium

$100\,000$ bytes with MSS $1460$ : $\lceil 100000/1460 \rceil = 69$ segments ( $68$ full and one of $720$ bytes). The data share of an Ethernet frame with a $1460$ -byte segment is $1460/1518 = 96.18$ percent.

EX 4Typical questions

GATE level

(a) "A client sends SYN with sequence number $5000$ . What are the sequence and acknowledgement numbers of the SYN+ACK if the server's ISN is $9000$ ?" seq $9000$ , ack $5001$ . (b) "How many segments are exchanged to open and to close a connection?" $3$ and $4$ . (c) "Does TCP count segments or bytes in its sequence numbers?" Bytes. (d) "How long until the sequence numbers wrap at $1$ Gbps?" $2^{32} \times 8 / 10^9 = 34.4$ s. (e) "What does the receiver acknowledge when segment $k+1$ is lost but $k+2$ arrives?" The same number as for segment $k$ (the first missing byte). (f) "Which flag is set in the second segment of the handshake?" SYN and ACK.

Cheat box

Reliable, ordered byte stream, full duplex, connection-oriented; 20-byte header; ports 16 bits.
Sequence number = first byte of the segment; acknowledgement = next byte expected (cumulative).
SYN and FIN each consume one sequence number; handshake: SYN, SYN+ACK, ACK; close: FIN, ACK, FIN, ACK.
MSS $=$ MTU $- 40$ . Wrap-around of $32$ bits at rate $R$ : $2^{32} \cdot 8 / R$ s.
ACK-only segments carry no data and use no sequence number.

Traps and GATE patterns

Connections

Builds on

IPv4 header and fragmentation

Unlocks

RTT estimation and retransmission timersPrerequisite ofplanned

Layering: OSI and TCP/IPuses IPv4 header and fragmentationcontrasts with Network address translationuses Sliding window: stop-and-wait, Go-Back-N, Selective Repeatimplemented by TCP flow controlPrerequisite of TCP flow controluses TCP congestion controluses RIP, OSPF and BGP overviewuses Socket APIPrerequisite of Socket APIuses HTTPuses UDP and portsPrerequisite of UDP and portscontrasts with

Across subjects

No cross-subject links yet.

Within this subject

Sliding window: stop-and-wait, Go-Back-N, Selective Repeatuses TCP flow controlimplemented-by TCP congestion controlimplemented-by UDP and portscontrasts-with Socket APIuses

TCP's reliability is the sliding window idea with cumulative acknowledgements (sliding window protocols). The window field limits the sender (flow control) and the congestion window adapts to the network (congestion control). Applications use TCP through sockets (socket API); UDP offers ports without these services.

PYQs

17 previous year questions from your book. I re-solved each one myself (5 by running or simulating, 12 by reasoning only); the book's key is shown next to my answer. All PYQs

year not read yetQ4 · page 547 of the book

With respect to a TCP connection between a client
and a server, which one of the following statements is
true?

(a)The client and server use a two-way handshake mechanism before the start of data transmission
(b)The server cannot initiate closing of the connection before the client initiates closing of the connection
(c)The TCP connection is half-duplex
(d)The client and server can initiate closing of the connection at the same time

GATE 2026 · NATQ5 · page 547 of the book

It is necessary to design a link-layer protocol between
two hosts that are directly connected over a lossless
link of length 3000 km. The link bandwidth is 108 bits
per second, and the propagation delay is 5 ns per
meter. Every transmitted data byte is assigned a
unique sequence number.

Let N be the minimum number of bits needed for the
sequence number field such that:

i. the sequence numbers do not wrap around before
60 seconds, and
ii. the maximum utilization of the link is achieved.

Find N. (answer in integer)

GATE 2025 · MCQQ8 · page 548 of the book

Consider the following statements:
 (i) Address Resolution Protocol (ARP) provides
a mapping from an IP address to the
corresponding hardware (link-layer) address.
 (ii) A single TCP segment from a sender S to a
receiver R cannot carry both data from S to R
and acknowledgment for a segment from R to S.

Which ONE of the following is CORRECT?

(a)Both (i) and (ii) are TRUE
(b)(i) is TRUE and (ii) is FALSE
(c)(i) is FALSE and (ii) is TRUE
(d)Both (i) and (ii) are FALSE

GATE 2025 · MSQQ13 · page 549 of the book

Consider the 3-way handshaking protocol for TCP
connection establishment. Let the three packets
exchanged during the connection establishment be
denoted as P1, P2, and P3, in order. Which of the
following option(s) is/are TRUE with respect to
TCP header flags that are set in the packets?

(a)P3: SYN = 1, ACK = 1
(b)P2: SYN = 1, ACK = 1
(c)P2: SYN = 0, ACK = 1
(d)P1: SYN = 1

GATE 2024 · MSQQ22 · page 550 of the book

TCP client P successfully establishes a connection to
TCP server Q. Let NP denote the sequence number in
the SYN sent from P to Q. Let NQ denote the
acknowledgment number in the SYN ACK from Q to
P. Which of the following statements is/are
CORRECT?

(a)The acknowledgment number NQ is equal to NP
(b)The sequence number NP is always 0 for a new connection
(c)The acknowledgment number NQ is equal to NP + 1
(d)The sequence number NP is chosen randomly by P

GATE 2023 · MSQ · 2 marksQ26 · page 551 of the book

Suppose You are asked to design a new reliable
byte-stream transport protocol like TCP, named
myTCP, which runs over a 100 Mbps network
with a Round Trip Time (RTT) of 150
milliseconds and a maximum segment lifetime of
2 minutes.
Which of the following is/are valid lengths of the
Sequence Number field in the myTCP header?

(a)30 bits
(b)32 bits
(c)34 bits
(d)36 bits

GATE 2022 · NAT · 2 marksQ30 · page 552 of the book

Consider the data transfer using TCP over a 1 Gbps
link. Assuming that the maximum segment lifetime
(MSL) is set to 60 seconds, the minimum number
of bits required for the sequence number field of the
TCP header, to prevent the sequence number space
from wrapping around during the MSL is
___________.

year not read yetQ33 · page 553 of the book

A TCP server application is programmed to listen
on port number P on host S. A TCP client is
connected to the TCP server over the network.
Consider that while the TCP connection was active,
the server machine S crashed and rebooted.
Assume that the client does not use the TCP
keepalive timer.

Which of the following behaviors is/are possible?

(a)If the client sends a packet after the server reboot, it will receive a FIN segment.
(b)If the client was waiting to receive a packet, it may wait indefinitely.
(c)The TCP server application on S can listen on P after reboot.
(d)If the client sends a packet after the server reboot, it will receive a RST segment.

GATE 2021 · MCQQ34 · page 553 of the book

Consider the three-way handshake mechanism
followed during TCP connection establishment
between hosts P and Q. Let X and Y be two random
32-bit starting sequence numbers chosen by P and
Q respectively. Suppose P sends a TCP connection
request message to Q with a TCP segment having
SYN bit = 1, SEQ number = X, and ACK bit = 0.
Suppose Q accepts the connection request. Which
one of the following choices represents the
information present in the TCP segment header that
is sent by Q to P?

(a)SYN bit = 1, SEQ number = Y, ACK bit = 1, ACK number = X + 1, FIN bit = 0
(b)SYN bit = 1, SEQ number = Y, ACK bit = 1, ACK number = X, FIN bit = 0
(c)SYN bit = 0, SEQ number = X + 1, ACK bit = 0, ACK number = Y, FIN bit = 1
(d)SYN bit = 1, SEQ number = X + 1, ACK bit = 1, ACK number = Y, FIN bit = 0

GATE 2018 · NAT · 1 markQ43 · page 554 of the book

Consider a long-lived TCP session with an end-to-end
bandwidth of 1 Gbps = (109 bits per second). The
session starts with a sequence number of 1234. The
minimum time (in seconds, rounded to the closest
integer) before this sequence number can be used
again is

GATE 2018 · MCQ · 1 markQ44 · page 554 of the book

Match the following:

Field
Length (bits)
P. UDP Header's Port Number
i. 48
Q. Ethernet MAC Address
ii. 8
R. IPv6 Next Header
iii. 32
S. TCP Header's Sequence Number iv. 16

COMPUTER NETWORK

(a)P-III, Q-IV, R-II, S-I
(b)P-II, Q-I, R-IV, S-III
(c)P-IV, Q-I, R-II, S-III
(d)P-IV, Q-I, R-III, S-II

GATE 2017 · MCQ · 1 markQ46 · page 555 of the book

Consider a TCP client and a TCP server running on
two different machines. After completing data
transfer, the TCP client calls close to terminate the
connection and a FIN segment is sent to the TCP
server. Server-side TCP responds by sending an
ACK, which is received by the client-side TCP. As
per the TCP connection state diagram (RFC 793),
in which state does the client-side TCP connection
wait for the FIN from the server-side TCP?

(a)LAST-ACK
(b)TIME-WAIT
(c)FIN-WAIT-1
(d)FIN-WAIT-2

year not read yetQ56 · page 556 of the book

Consider the following statements:
I. TCP connections are full duplex.
II. TCP has no option for selective acknowledgment.
III. TCP connections are message streams.

(a)Only I is correct
(b)Only I and II are correct
(c)Only II and III are correct
(d)All of I, II, and III are correct

GATE 2015 · MCQQ59 · page 557 of the book

Suppose two hosts use a TCP connection to transfer
a large file. Which of the following statements
is/are FALSE with respect to the TCP connection?
1. If the sequence number of a segment is m, then
the sequence number of the subsequent segment
is always m+1.
2. If the estimated round trip time at any given
point of time is t sec, the value of the
retransmission timeout is always set to greater
than or equal to t sec.
3. The size of the advertised window never
changes during the course of the TCP
connection.
4. The number of unacknowledged bytes at the
sender is always less than or equal to the
advertised window.

(a)3 only
(b)1 and 3 only
(c)1 and 4 only
(d)2 and 4 only

GATE 2009 · MCQ · 2 marksQ81 · page 561 of the book

While opening a TCP connection, the initial
sequence number is to be derived using a time-of-
day (ToD) clock that keeps running even when the
host is down. The low order 32 bits of the counter of
the ToD clock is to be used for the initial sequence
numbers. The clock counter increments once per
millisecond. The maximum packet lifetime is given
to be 64 s.

Which one of the choices given below is closest to the
minimum permissible rate at which sequence
numbers used for packets of a connection can
increase?

(a)0.015/s
(b)0.064/s
(c)0.135/s
(d)0.327/s

GATE 2008 · MCQ · 1 markQ86 · page 562 of the book

Which of the following system calls results in the
sending of SYN packets?

(a)socket
(b)bind
(c)listen
(d)connect

GATE 2008 · MCQ · 1 markQ18 · page 579 of the book

What is the maximum size of data that the application
layer can pass on to the TCP layer below?

(a)Any size
(b)216 bytes - size of TCP header
(c)216 bytes
(d)1500 bytes

Self-check

Question 1

The client's ISN is $100$ ; it sends $300$ bytes and then closes. What is the sequence number of its FIN?

Show answer

SYN uses $100$ , data are $101 \dots 400$ , so FIN has sequence number $401$ .

Question 2

MTU $= 1500$ . What MSS, and why not $1500$ ?

Show answer

$1460$ : the $20$ -byte IP header and $20$ -byte TCP header must fit in the MTU, so that IP does not fragment.

Question 3

Why does the close need four segments although the open needs three?

Show answer

Each direction is closed independently (a side may still have data to send after the other side has finished); the server's ACK and FIN can be sent separately.

Revision card

One-screen revision

Byte stream; seq $=$ first byte, ack $=$ next byte expected; SYN and FIN use one number.
Open: SYN, SYN+ACK, ACK. Close: FIN, ACK, FIN, ACK; TIME_WAIT.
MSS $=$ MTU $- 40$ ; $32$ -bit numbers wrap in $2^{32} \cdot 8 / R$ s.

References

·Kurose, Ross, Computer Networking: A Top-Down Approach (8th edition), Chapter 3, Section 3.5 (Connection-oriented transport: TCP)
·Tanenbaum, Wetherall, Computer Networks (5th edition), Chapter 6, Section 6.5 (The Internet transport protocols: TCP)
·Forouzan, Data Communications and Networking (5th edition), Chapter 24 (Transport layer: TCP)

Verification

scripts/enum-checks/cn_tcp_check.py: 2000 random transfers (initial sequence numbers including values within 3000 of 2^32 so that the numbers wrap around, 0 to 5000 bytes each way, MSS 100, 536 or 1460) were generated by scripts/cn_tcp.py (tcp_session) and replayed by a separate loop: every segment carries the sender's next sequence number, every acknowledgement number equals the next sequence number the peer is going to use (the next byte expected), data per segment never exceeds the MSS, the byte totals match, and SYN and FIN each consume exactly one sequence number (final numbers = initial + 1 + bytes + 1 on both sides). The wrap-around times 2^32 x 8 / rate (34.36 s at 1 Gbps, 3435.97 s at 10 Mbps) were recomputed. MODEL: no loss, no reordering, every data segment acknowledged separately (real TCP uses delayed and cumulative acknowledgements), the closing sequence FIN-ACK-FIN-ACK with the client closing first. QUOTED from the RFCs and textbooks, not verified here: the header layout and flag list, the options (MSS, window scale, timestamps, SACK), the state machine and its state names, the 2 MSL waiting time in TIME_WAIT, the maximum segment lifetime of 120 s used for the wrap-around comparison, the simultaneous open and close variations and RST segments. Textbook chapter references are from memory. SECOND PASS (2026-11-02, done by the assistant, not a human check): every Self-check question was solved before the printed answer was read and all agreed; the definitions, worked examples, cheat box and traps were read claim by claim and the numbers re-derived by hand or by a small script (CRC remainders, binomial tail, checksums); long C programs were not re-read line by line (they are compiled and compared by npm run verify:c, and their printed outputs were checked against the prose). No defect found. Status raised to self-checked; verified needs a textbook or human check.

last verified: never

My notes (saved in this browser)

Link state routing

Sliding window: stop-and-wait, Go-Back-N, Selective Repeat