Monday, 21 May 2018

TCP Flow Control - Window Size and Acknowledgment

TCP is the protocol that guarantees a reliable communication channel over an unreliable network. When someone sends data from a host to another, packets can be lost, they can arrive at the receiving host out of order, the network can be congested or the receiver node can be overloaded. When we are sending some application data, we usually don’t need to deal with this complexity, we just write data to a socket and TCP makes sure the packets are delivered correctly to the receiver node. The TCP provides important service which is called TCP Flow Control.


The quantity of data that the destination host can receive and process reliably. TCP flow control is the service which maintains the reliability of TCP transmission by adjusting the rate of data flow between the source host and destination host for an established session. To achieve this, the TCP header includes a 16-bit field called the window size.


The figure below illustrates an example of window size and its acknowledgments. The window size is the number of bytes that the destination device of a TCP session can accept and process a single time. In this example, host B’s initial window size for the TCP session is 1,000 bytes. Starting with the first byte, byte number 1; the final byte PC A can send without receiving acknowledgments is byte 1,000. This is known as PC A’s send window. The window size is included in every TCP segment so the receiver can adjust the window size at any time depending on buffer availability.


The figure illustrates, the source is transmitting 1,500 bytes of data within each TCP segment. This is known as the MSS (Maximum Segment Size).


TCP flow_Window


The primary window size is settled upon when the TCP session is established during the three-way handshake. The source host must bound the number of bytes sent to the destination host based on the destination’s window size.



Only after the source host receives an acknowledgment that the all the bytes have been received at the destination host, can it continue sending more data for the session. Usually, the destination host will not wait for all the bytes for its window size to be received before replying with an acknowledgment. As the bytes are received and processed; the destination host will send acknowledgments to inform the source host that it can continue to send additional bytes.


Usually, host B will not wait until all 4,500 bytes have been received before sending an acknowledgment. This means host A can correct its send window as it receives acknowledgments from host B. As shown in the figure below, when host A receives an acknowledgment with the acknowledgment number 3,001, host A’s send window will increment another 4,500 bytes (the size of host B’s current window size) to 7,500. host A can now continue to send up to another 4,500 bytes to host B as long as it does not send past its new send window at 7,500. The process of the destination host sending acknowledgments as it processes bytes received and the continual adjustment of the source’s send window is known as sliding windows.


If the availability of the destination’s buffer space decreases; it may reduce its window size to inform the source to reduce the number of bytes it should send without receiving an acknowledgment. The window size determines the number of bytes that can be sent before expecting an acknowledgment. The acknowledgment number is the number of the next expected byte.


TCP Flow Control - Congestion Avoidance


When congestion occurs on a network, it results in packets being discarded by the overloaded router. When packets containing TCP segments don’t reach their destination, they are left unacknowledged. By determining the rate at which TCP segments are sent but not acknowledged; the source host can suppose a certain level of network congestion.


One of the main principles for congestion control is avoidance. TCP tries to sense symbols of congestion earlier than it happens and to reduce or increase the load into the network accordingly. The option of waiting for congestion and then reacting is not as good as because once a network saturates; it does so at an exponential growth rate and decreases on the whole throughput enormously. It takes a long time for the queues to consume, and then all senders host again repeat this phase. By taking a practical congestion avoidance approach; the pipe is kept as full as possible without the threat of network saturation. The key is for the sender host to recognize the state of the network and client and to control the amount of traffic injected into the system.


Whenever there is congestion, retransmission of lost segments from the source will take place. If the retransmission is not properly controlled, the extra retransmission of the TCP segments can make the congestion even worse. Not only are new packets with TCP segments introduced into the network; but the feedback effect of the retransmitted TCP segments that were lost will also add to the congestion. To avoid and control congestion, TCP employs several congestion management mechanisms, timers, and algorithms.


If the source host determines that the TCP segments are either not being acknowledged or not acknowledged in a timely. Then it can reduce the number of bytes it sends before receiving an acknowledgment. Note that it is the source host that is decreasing the number of unacknowledged bytes it sends and not the window size determined by the destination. The figure below illustrates the TCP congestion control. The acknowledgment number is for next expected byte not for the segment.


TCP flow_Windowing

Sunday, 20 May 2018

TCP Reliability - The Segment Ordered Delivery

Transmission Control Protocol accepts data from a stream, divides it into small chunks, and adds a TCP header creating a TCP segment. The TCP segment is then encapsulated into an Internet Protocol datagram (IP datagram) and exchanged with peers.


These TCP segments possibly will arrive at their destination out of order. For the original message to be understood by the receiver; the data in these out of order segments are reassembled into the original order. Sequence numbers are assigned in the header of each segment to get this goal. The sequence number represents the first data byte of the TCP segment.


During the established session, the first sequence number (ISN) is set. This ISN represents the opening value of the bytes for this session that is transmitted to the receiving side application. As data is transmitted during the established session, the sequence number is incremented by the number of bytes that have been transmitted. This data byte tracking enables every segment to be individually identified and acknowledged. Missing segments can then be identified and then reported. The ISN is effectively a random number. This is to avoid certain types of malicious attacks. For simplicity, we will use an ISN of 1 for the examples. sequence numbers indicate how to reassemble and reorder received segments, as shown in the figure.


segment_tcp_reliability


The receiving TCP process places the data from a segment into a receiving buffer. Segments are placed in the proper sequence order and passed to the application layer when reassembled. Any segments that arrive with sequence numbers that are out of order are seized for later processing. in that case, when the segments with the missing bytes reach the destination, these segments are processed in proper order.

TCP Three-way Handshake

The TCP three-way handshake also called the TCP-handshake.  Three message handshake and/or SYN SYN-ACK ACK is the method used by TCP set up a TCP/IP connection over an IP based network. TCP's three-way handshaking is often referred to as SYN, SYN-ACK, ACK technique because there are three messages transmitted by TCP to negotiate and start a TCP session between two hosts.


Hosts on the network follow each data segment within a session and exchange information about what data is received using the information in the TCP header. TCP is a full-duplex protocol, where each connection represents two one-way communication streams or sessions. To establish the connection, the hosts perform a TCP three-way handshake. Control bits in the TCP header indicate the progress and status of the connection.


The TCP handshaking mechanism is designed that two hosts attempting to communicate can negotiate the parameters of the. TCP socket connection before transmitting data. This 3-way handshake process is also designed so that both ends can initiate and negotiate separate TCP socket connections at the same time. Being able to negotiate multiple TCP socket connections in both directions at the same time allows a single physical network interface, such as Ethernet, to be multiplexed to transfer multiple streams of TCP data simultaneously.




The step of the TCP three-way handshake



  • Establishes that the destination device is present on the network; Host A sends a TCP SYNchronize packet to Host B

  • Verifies that the destination device has an active service and is accepting requests on the destination port number that the initiating Host intends to use. Host B receives A's SYN and then Host B sends a SYNchronize-ACKnowledgement

  • Informs the destination device that the source Host intends to establish a communication session on that port number; Host A receives host B's SYN-ACK and then Host A sends ACKnowledge

  • Host B receives Host A’s ACK. And then TCP socket connection is ESTABLISHED.


The figure illustrates the step of the three-way handshake.


TCP three-way handshake


After the data sending is completed, the sessions are closed, and the connection is terminated. The connection and session mechanisms enable TCP’s reliability function. Here, another 3-way communication is performed to tear down the TCP socket connection. This setup and teardown of a TCP socket connection is part of what qualifies TCP a reliable protocol. TCP also acknowledges that data is successfully received and guarantees the data is reassembled in the correct order.

Monday, 14 May 2018

TCP Server Processes

All application processes running on the server are configured to use a different port number. The port can be configured by default or manually, by a network administrator. On the same server cannot have two services assigned the same port number within the same transport layer services. For example, a host running FTP server and a web server cannot have both configured to use the same port (for example, TCP port 80 for both or port 21 FTP server port for both).


An active server application assigned a specific port, mean that port is considered to be open, which means that the transport layer accepts and processes segments addressed to that specific port number. Every incoming client request addressed to the correct socket is accepted, and the data is passed to the application on the server. There may be many ports open at the same time on a server, one for each active server application.


TCP Connection Establishment


Shake Hands!  When two persons meet each other, they often welcome each other by shaking hands. This act of hands shake is understood by both as a sign for a friendly welcoming. Connections on the network are similar to the handshaking.




A TCP connection between host and server or between two hosts is established in three steps:


Step 1 - The initiating client send requests a client-to-server communication session with the server.


Step 2 – After receiving the request the server acknowledges the client-to-server communication session and requests a server-to-client communication session.


Step 3 – Then the initiating client acknowledges the server-to-client communication session.




[caption id="attachment_7930" align="alignnone" width="569"]tcp TCP Connection Establishment[/caption]


In the figure, you can see the TCP connection establishment.   


TCP Session Termination


For connection closing, the FIN control flag must be set in the segment header. To end each one-way TCP session, a two-way handshake, with a FIN segment and an Acknowledgment (ACK) segment, is used. So, to terminate a single TCP conversation, four exchanges are required to end both sessions.


Step 1 - When the Host-A Send All data and no more data remain to send in the stream, it sends a segment with the FIN flag set to Host-B.


Step 2 - The Host-B sends an ACK to acknowledge the receipt of the FIN to finish the session from Host- A to Host-B.


Step 3 - The Host-B sends a FIN to the Host-A to finish the Host-B to Host-A session.


Step 4 - The Host-A responds with an ACK to acknowledge the FIN from the Host-B.


When all segments have been acknowledged, the session is closed.


The Figure below illustrates the TCP session termination process.




[caption id="attachment_7931" align="alignleft" width="504"]tcp TCP Session Termination[/caption]

Tuesday, 8 May 2018

The netstat Command

Unexplained TCP connections can create a major security risk. They can show that something or someone is connected to the local host. Sometimes it is necessary to know which active TCP connections are open and running on a networked host. Netstat is a useful network tool for checking and verifying those connections.


The netstat command can show particulars about individual network connections, overall and protocol-specific networking statistics, all listening ports, along with incoming and outgoing network connections and much more, all of which could help troubleshoot certain kinds of networking issues. By default, the netstat command will try to resolve IP addresses to domain names and port numbers to well-known applications.


There are various ways that a system administrator might use the assortment of switches with netstat command. I will give you a complete detail in this article.




Open the Command Prompt and execute the netstat command alone to show a comparatively simple list of all active TCP connections which, for each one, will show the local IP address, the foreign IP address, along with their relevant port numbers, as well as the TCP state.


 Netstat Command Syntax


netstat [-a] [-b] [-e] [-f] [-n] [-o] [-p protocol] [-r] [-s] [-t] [-x] [-y] [time_interval] [/?]





























































Switches for Netstat command



Switch



Description



-a



The -a switch displays all active TCP connections and the TCP and UDP ports on which the computer is listening.



-b



The -b switch displays the executable concerned in creating each connection or listening port. This switch is added in XP SP2.



-e



The -e switch displays Ethernet statistics, such as the data includes the number of bytes and packet sent and received  including  unicast packets, non-unicast packets, discards, errors, and unknown protocols since the connection was established.



-f



The -f switch will force the netstat command to display the (FQDN ) Fully Qualified Domain Name  for each foreign host IP addresses when possible.



-n



The -n switch could significantly decrease the time it takes for netstat to fully execute. The switch will show active TCP connections, but, addresses and port numbers are expressed numerically.



-o



This switch displays active TCP connections and includes the process ID (PID) for all connections. You can find the application based on the PID on the Processes tab in Windows Task Manager. This parameter can be combined with -a-n, and -p.



-p proto



Using the -p switch to show connections or statistics only for a particular protocol. You can’t define more than one protocol at once, nor can you execute netstat with -p switch without defining a protocol. proto may be any of TCP, UDP, TCPv6, or UDPv6. If you use -s with -p to view statistics by protocol, you can use icmpIPicmpv6, or ipv6 in addition to the first four I mentioned.



-r



The -r switch displays the contents of the IP routing table. This is equivalent to the route print command.



-s



The -s switch displays statistics per-protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. If the IPv6 is installed, statistics are shown for the TCP over IPv6, UDP over IPv6, ICMPv6, and IPv6 protocols. The -p parameter can be used to specify a set of protocols, but be sure to use -s before -p protocol when using the switches together.



-t



Using -t switch will show the current TCP pipe offload state in place of the typically displayed TCP state.



[interval]



An integer used to display results multiple times with a specified number of seconds between displays. Continues until stopped by command ctrl+c. The default setting is to display once.



/?



? is Used to show details about the netstat command's several options.



 


Netstat Command Examples


netstat -f


This is the example of a netstat with -f switch. I execute netstat to show all active TCP connections. but, I do want to see the computers I'm connected to in FQDN format [-f] instead of a simple IP address.


Here's an example of what you might see:









C:\User\Muhammad>netstat -f


Active Connections


  Proto  Local Address          Foreign Address        State


  TCP    127.0.0.1:49216        Muhammad-PC:49328      ESTABLISHED


  TCP    127.0.0.1:49328        Muhammad-PC:49216      ESTABLISHED


  TCP    192.168.58.101:49273   .:https                CLOSE_WAIT


  TCP    192.168.58.101:49322   wo-in-f188.1e100.net:5228  ESTABLISHED


  TCP    192.168.58.101:49726   51.143.22.239:http     SYN_SENT


  TCP    192.168.58.101:49727   xx-fbcdn-shv-02-sin6.fbcdn.net:https  ESTABLISHED


  TCP    192.168.58.101:49728   edge-star-mini-shv-02-sin6.facebook.com:https  ESTABLISHED


  TCP    192.168.58.101:49729   edge-star-mini-shv-02-sin6.facebook.com:https  TIME_WAIT


  TCP    192.168.58.101:49730   182.176.35.18:https    TIME_WAIT


  TCP    192.168.58.101:49731   182.176.35.18:https    ESTABLISHED


  TCP    192.168.58.101:49736   xx-fbcdn-shv-02-sin6.fbcdn.net:https  TIME_WAIT


  TCP    192.168.58.101:49737   182.176.35.17:https    ESTABLISHED


  TCP    192.168.58.101:49739   18.55.c0ad.ip4.static.sl-reverse.com:https  ESTABLISHED


  TCP    192.168.58.101:49740   18.55.c0ad.ip4.static.sl-reverse.com:https  ESTABLISHED


  TCP    192.168.58.101:49741   edge-star-shv-02-sin6.facebook.com:https  SYN_SENT


  TCP    192.168.58.101:49742   edge-star-shv-02-sin6.facebook.com:https  ESTABLISHED



 


The command shows that there are 16 active TCP connections at the time of execution. The only protocol (in the Proto column) listed is TCP, if udp is required then you can use -a switch with n switch to reduce the execution time.


netstat  -an








  C:\User\Muhammad> netstat -an 

Active Connections


  Proto  Local Address          Foreign Address        State


  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING


  TCP    127.0.0.1:49158        0.0.0.0:0              LISTENING


  TCP    127.0.0.1:49158        127.0.0.1:49214        ESTABLISHED


  TCP    192.168.58.103:49695   178.255.83.1:80        TIME_WAIT


  TCP    192.168.58.103:49696   23.46.123.27:80        ESTABLISHED


  TCP    192.168.58.103:49697   178.255.83.1:80        TIME_WAIT


  TCP    192.168.58.103:49708   93.184.220.29:80       ESTABLISHED


  TCP    192.168.58.103:49730   50.97.63.217:443       CLOSE_WAIT


  TCP    192.168.58.103:49731   50.97.63.217:443       ESTABLISHED


  TCP    192.168.58.103:49732   216.58.208.68:80       ESTABLISHED


  TCP    192.168.58.103:49733   216.58.208.68:80       TIME_WAIT


  TCP    192.168.58.103:49741   52.20.224.89:443       ESTABLISHED


  TCP    192.168.58.103:49742   52.20.224.89:443       TIME_WAIT


  TCP    192.168.58.103:49757   192.169.80.98:80       TIME_WAIT


  TCP    192.168.58.103:49758   192.169.80.98:80       ESTABLISHED


  TCP    192.168.58.103:49759   172.217.19.34:80       TIME_WAIT


  TCP    192.168.58.103:49760   172.217.19.34:80       ESTABLISHED


  TCP    192.168.58.103:49763   35.187.117.15:80       TIME_WAIT


  TCP    192.168.58.103:49838   52.221.160.235:443     ESTABLISHED


  TCP    192.168.58.103:49839   52.221.160.235:443     ESTABLISHED


  TCP    [::]:135               [::]:0                 LISTENING


  TCP    [::]:445               [::]:0                 LISTENING


  UDP    [::1]:62889            *:*


  UDP    [fe80::71dd:e26c:b955:52be%12]:546  *:*


  UDP    [fe80::71dd:e26c:b955:52be%12]:1900  *:*



 


 


The information above that is displayed in the result of the netstat –an command including protocol, the local address and port number, the foreign address and port number, and the connection status. An explanation of the different connection states is given below:


















































State



Description



LISTENING



This status shows that the server is ready to accept a connection



CLOSED



Closed status shows that the server has received an ACK signal from the client and the connection is closed now.



CLOSE_WAIT



This status shows that the server has received the first FIN from the client and the connection is in the process of being closed



ESTABLISHED



This status means that the server received the SYN signal from the client and the session is now established.



FIN_WAIT_1



This status means that the connection is still active but not currently in use.



FIN_WAIT_2



This status Indicates that the client now received acknowledgment of the first FIN signal from the server.



LAST_ACK



This status shows that the server is in the process of sending its own FIN



SYN_SEND



This means that this particular connection is open and active



SYN_RECEIVED



The status means that the server just received an SYN signal from the client



TIME_WAIT



This status means that the client recognizes the connection as still active but not currently being used


Saturday, 21 April 2018

Port Numbers

There is two types of port are being used in a transport layer, the source ports, and destination ports. The source ports are related to the originating application on the local host. The destination ports are related to the destination application on the remote host.


Source Port


The source ports are dynamic ports, generated by the originating device to identify a conversation between two devices. This process allows multiple conversations to take place at the same time. It is common for a device to send multiple HTTP service requests to a web server at the same time. Each separate HTTP conversation is tracked based on the number of source ports.


Destination Port


The client attaches a destination port number in the segment to inform the destination server what service is being requested, For example, when a client specifies port 21 in the destination port, the server that receives the message knows that FTP services are being requested. A server can offer more than one service simultaneously such as FTP services on port 21 and web services on port 80 at the same time. The figure below illustrates both requests at the same time.




Socket Pairs


Both source and destination ports are placed within the segment and then the segments are encapsulated within an IP packet. The IP packet contains both the source and destination IP addresses. The combination of the source IP address and source port number, or the destination IP address and destination port number is known as a socket. The socket is used to recognize the server and service being requested by the user. A user socket might look like this, with 1124 representing the source port number: 192.168.10.200:1124 and the socket on a web server might be: 192.168.10.50:80


Together, these two sockets combine to form a socket pair: 192.168.10.200:1124, 192.168.10.50:80. The Figure below illustrates the connection and socket of web and FTP ports.


socket and port


The sockets are enabled multiple processes, running on a client, to differentiate themselves from each other, and multiple connections to a server process to be differentiated from each other. The source port number used as a return address for the requesting application. The transport layer keeps a track record of this port and the application that initiated the request so that when a reply is returned, it can be forwarded to the right application.


Ports Number Groups


The Internet Assigned Numbers Authority (IANA) is the authority for assigning various addressing standards and ports numbers. There are three different types of ports.



  • Well-known Ports (Numbers 0 to 1023) – These are the ports reserved for services and applications. These ports are generally used for applications such as web browsers, email clients, and remote access clients. These well-known ports can be programmed for server applications and client applications to request a connection to that specific ports and its associated service.

  • Registered Ports (Numbers 1024 to 49151)- These ports are assigned by Internet Assigned Numbers Authority (IANA) to a requesting person to use with particular processes or applications. These processes are mostly individual applications that a user has selected to install and use; rather than common applications that would receive a well-known port number.

  • Dynamic or Private Ports (Numbers 49152 to 65535)– These ports are also known as ephemeral ports; these are generally assigned dynamically by the client’s operating system when a connection to a service is initiated. The dynamic ports are then used to identify the client application during communication. Some client operating systems may be used registered port numbers instead of dynamic ports numbers for assigning source ports.

Introduction to UDP

UDP is a connectionless protocol Which is not a reliable protocol. it means that it has no guarantee to get its destination. Example of this protocol is that when you are sending a non-registered letter or postcard, you put it in the mailbox. Now you are not aware of the availability of the receiver to receive the letter and chances are good that it will get where it's supposed to go but there is no guarantee. There is always a possibility of loss in the way. The post office is not responsible for tracking the letter or informing the sender if the letter does not arrive at the final destination. The UDP is working Just like the above example.


 

UDP provides the basic functions for delivering data segments between the right applications, with very small overhead and data checking. It is recognized as an unreliable protocol because there is no acknowledgment that the data is received at the destination. With User Datagram, there are no transport layer processes that inform the sender of a successful delivery.
While the TCP reliability functions provide more vigorous communication among applications, they also gain extra overhead and possible delays in transmission.


UDP Features


User Datagram Protocol is a best-effort transport protocol. It is a lightweight transport protocol that offers the same data segmentation and reassembly as TCP; but with no TCP reliability and flow control. UDP is a simple protocol that it is usually described in terms of what it does not do compared to TCP.
No Ordered Data Reconstruction – Data is reconstructed in the order of that it is received.
Unreliable Delivery – Any segments lost are not resent in this protocol like TCP.
Connectionless – No session are established with the source and destination.
No Flow Control – Does not inform the sender about the resource availability.


UDP Header


It is a stateless protocol because it does not inform the source and destination about the packets receiving and it does not give any state of the communication session to client and server. If reliability is required when using UDP as the transport protocol, it must be handled by the application.
An application can accept some loss of data during transmission over the network, but delays in transmission are unacceptable. UDP is the choice for these applications because less network overhead is required. It is preferable for streaming live audio, live video, and Voice over IP (VoIP).
UDP header is called datagrams, as shown in the figure. These datagrams are sent as best-effort by the transport layer protocol. UDP has a low overhead of 8 bytes.


udp