当前位置：网站首页>Classic theory: detailed explanation of three handshakes and four waves of TCP protocol

Classic theory: detailed explanation of three handshakes and four waves of TCP protocol

2022-06-26 05:06:00 【JackJiang-】

1、 Preface

Even though TCP and UDP All use the same network layer （IP）,TCP But to the application layer UDP A completely different service .TCP Provides a connection-oriented 、 Reliable byte stream service .

Connection-oriented means two USES TCP Application （ Usually a client and a server ） You have to create a before you can exchange data with each other TCP Connect . The process is very similar to making a phone call , Ring first , Waiting for the other party to pick up the machine and say “ feed ”, Then it's about who .

This article will explain the classic TCP The protocol establishes the connection （ So-called “3 The second handshake ”） And disconnect （ So-called “4 Second wave ”） The process of . of TCP Introduction to the authoritative theory of agreement , Please see the 《TCP/IP Detailed explanation 》 This book .（ This article is published synchronously in ：http://www.52im.net/thread-258-1-1.html）

2、 Exchange of learning

- Instant messaging development communication group ： 215891622 [ recommend ]

- Mobile IM Develop recommended articles ：《 Beginner level one is enough ： Develop mobile from scratch IM》

3、 Related information

《 Technology past ： Change the world TCP/IP agreement （ Precious pictures 、 Be careful with your mobile phone ）》
《TCP/IP Detailed explanation - The first 17 Chapter ·TCP： Transmission control protocol 》
《TCP/IP Detailed explanation - The first 18 Chapter ·TCP Connection establishment and termination 》
《TCP/IP Detailed explanation - The first 21 Chapter ·TCP Over time and retransmission 》
《 Easy to understand - In depth understanding of TCP agreement （ On ）： Theoretical basis 》
《 Easy to understand - In depth understanding of TCP agreement （ Next ）：RTT、 The sliding window 、 Congestion handling 》
《 Theoretical Classics ：TCP Agreed 3 Shake hands with 4 Detailed explanation of the wave process 》
《 Computer network communication protocol diagram （ Chinese Collection Edition ）》

4、 Let's get to know TCP Message format

TCP/IP For details of the agreement, please refer to 《TCP/IP protocol 》 In the relevant TCP Format chapter （ Click here to view the 《TCP/IP Detailed explanation Online version 》）.

Here is TCP Message format chart ：

There are several fields in the above figure that need to be highlighted ：
（1） Serial number ：Seq Serial number , Occupy 32 position , Used to identify from TCP Byte stream sent from source to destination , Flag this when the initiator sends data .
（2） Confirm the serial number ：Ack Serial number , Occupy 32 position , Only ACK Sign bit is 1 when , Verify that the ordinal field is valid ,Ack=Seq+1.
（3） Sign a ： common 6 individual , namely URG、ACK、PSH、RST、SYN、FIN etc. , The specific meaning is as follows ：
   （A）URG： Pointer to an emergency （urgent pointer） It works .
   （B）ACK： Confirm that the serial number is valid .
   （C）PSH： The receiver should send this message to the application layer as soon as possible .
   （D）RST： Reset connection .
   （E）SYN： Initiate a new connection .
   （F）FIN： Release a connection .

It should be noted that ：
（A） Do not confirm the serial number Ack And in flags ACK Confused. .
（B） Confirmation party Ack= Initiator Req+1, Pairing at ends .

5、3 The handshake process is explained in detail

Three handshakes （Three-Way Handshake） Namely establishment TCP Connect , It means building a TCP When the connection , The client and server are required to send in total 3 Packages to confirm connection . stay socket Programming , This process is performed by the client connect To trigger , The whole process is shown in the figure below ：

（1） The first handshake ：
Client Flag location SYN Set as 1, Randomly generate a value seq=J, And send the packet to Server,Client Get into SYN_SENT state , wait for Server confirm .

（2） The second handshake ：
Server Flag bit after receiving packet SYN=1 know Client Request to establish a connection ,Server Flag location SYN and ACK All are set for 1,ack=J+1, Randomly generate a value seq=K, And send the packet to Client To confirm the connection request ,Server Get into SYN_RCVD state .

（3） The third handshake ：
Client After receiving the confirmation , Check ack Is it J+1,ACK Is it 1, Flag bit if correct ACK Set as 1,ack=K+1, And send the packet to Server,Server Check ack Is it K+1,ACK Is it 1, If it is correct, the connection is established successfully ,Client and Server Get into ESTABLISHED state , Complete three handshakes , And then Client And Server You can start transferring data between .

SYN attack ：

During the three handshakes ,Server send out SYN-ACK after , received Client Of ACK Previous TCP A connection is called a half connection （half-open connect）, here Server be in SYN_RCVD state , When I received ACK after ,Server into ESTABLISHED state .SYN Attack is Client Forging a large number of nonexistent IP Address , And to Server Constantly sending SYN package ,Server Reply confirmation package , And wait for Client The confirmation of , Because the source address does not exist , therefore ,Server Need to resend until timeout , These fake SYN The packet will take up the time of the unconnected queue , Cause normal SYN The request was dropped because the queue was full , Thus, the network is blocked or even the system is paralyzed .SYN A typical attack DDOS attack , testing SYN The way to attack is very simple , When Server There are a large number of semi connected states and sources on IP The address is random , It can be concluded that SYN attacked , Use the following command to make it active ：

1	`#netstat -nap \| grep SYN_RECV`

6、4 Detailed explanation of the wave process

Three handshakes are familiar , It is estimated that few people will know four waves . Four waves （Four-Way Wavehand） Termination TCP Connect , To disconnect one TCP When the connection , The client and server are required to send in total 4 Packages to confirm disconnection . stay socket Programming , This process is performed by either the client or the server close To trigger , The whole process is shown in the figure below ：

because TCP Full duplex on connection , therefore , Each direction must be closed separately , The principle is that when one party completes the data transmission task , Send a FIN To terminate the connection in this direction , Receive a FIN It just means there's no data flow in this direction , No more data , But here TCP Data can still be sent on the connection , Until it's sent in that direction FIN. Active shutdown will be performed by the first party to close , The other party performs a passive shutdown , This is what is described above .

First wave ：
Client Send a FIN, Used to close Client To Server Data transfer of ,Client Get into FIN_WAIT_1 state .
Second wave ：
Server received FIN after , Send a ACK to Client, Confirmation No. is receipt No +1（ And SYN identical , One FIN Occupy a sequence number ）,Server Get into CLOSE_WAIT state .
Third wave ：
Server Send a FIN, Used to close Server To Client Data transfer of ,Server Get into LAST_ACK state .
Fourth wave ：
Client received FIN after ,Client Get into TIME_WAIT state , And then send a ACK to Server, Confirmation No. is receipt No +1,Server Get into CLOSED state , Finish four waves .

There's a party on top that's shutting down , Passive closing of the other party , In practice, active shutdown will be initiated at the same time , The specific process is shown in the following figure ：

The process and status are already clear in the figure above , No more details here , Refer to the previous four wave analysis steps .

7、 Conclusion

There are typical interview questions about three handshakes and four waves , It is hereby proposed that XDJM Reference ：

(1) What or process is three handshakes ？ Four handshakes ？ The first analysis is .
(2) Why three handshakes to establish a connection , Closing the connection is four waves ？

This is because the server is in LISTEN State, , Received a request to establish a connection SYN After the message , hold ACK and SYN Put it in a message and send it to the client . And when you close the connection , When receiving from the other party FIN When the message , It simply means that the other party is no longer sending data but can still receive data , You may not have sent all your data to the other party , So we can immediately close, You can also send some data to the other party , Send again FIN Message to the other party to agree to close the connection now , therefore , Own side ACK and FIN It's usually sent separately .

（ This article is published synchronously in ：http://www.52im.net/thread-258-1-1.html）

appendix ： more IM Technical articles

author ：Jack Jiang ( Click the author name to enter Github)
Source ：http://www.52im.net/space-uid-1.html
communication ： Welcome to the instant messaging development exchange group 215891622
Discuss ：http://www.52im.net/
Jack Jiang At the same time 【 original Java Swing Appearance engineering BeautyEye】 and 【 Lightweight mobile instant messaging framework MobileIMSDK】 The author of , You can go to download and exchange .