TCP & UDP Deep Dive: Flow Control, Congestion Control & Handshakes Explained

TCP Protocol Deep Dive

1. TCP Header Fields

The TCP header contains the following key fields: Source Port (16 bits) Destination Port (16 bits) Sequence Number (32 bits) Acknowledgment Number (32 bits) Header Length (4 bits, unit = 4 bytes, default 5 → 20 bytes) Reserved (6 bits) Control Flags (6 bits): SYN, ACK, FIN, PUSH, URG,

RST

Window Size

(16 bits) – receiver window for flow control; zero window triggers probe Checksum (16 bits) – covers header, data, padding; verified at both ends Urgent Pointer (16 bits) – valid only when URG =1; marks end of urgent data

2. Flow Control

Flow control ensures the sender does not overwhelm the receiver. It uses a sliding window mechanism:

The receiver advertises its receive window (rwnd) in the TCP header.

The sender's effective window = min(cwnd, rwnd).

When rwnd = 0, the sender starts a persistent timer and sends zero-window probe segments.

Even with zero window, the receiver must accept: zero-window probes, pure ACKs, and segments carrying urgent data.

3. Congestion Control

Congestion control reduces the sending rate when the network is congested. Assumptions: unidirectional data flow, receiver buffer always sufficient, units in MSS (Maximum Segment Size).

Key Variables

MSS

– Maximum Segment Size ssthresh – slow-start threshold cwnd – congestion window swnd – send window =

min(cwnd, rwnd)

RTT

– round-trip time

Slow Start + Congestion Avoidance

Initially cwnd = 1 MSS; each ACK increases cwnd by 1 MSS (exponential growth).

When cwnd ≥ ssthresh, switch to congestion avoidance : increase cwnd by 1 MSS per RTT (linear growth).

On timeout: ssthresh = cwnd/2, cwnd = 1, restart slow start.

Fast Retransmit

Receiver sends duplicate ACKs for out-of-order segments.

Sender receives 3 duplicate ACKs → assumes segment loss → retransmits immediately without waiting for timeout.

Fast Recovery

After fast retransmit: ssthresh = cwnd/2, cwnd = ssthresh + 3 MSS (for the 3 dup ACKs).

Each additional dup ACK increments cwnd by 1 MSS.

When new ACK arrives: cwnd = ssthresh, enter congestion avoidance.

4. Connection Establishment & Termination

4.1 Three-Way Handshake

Client → Server: SYN=1, seq=x Server → Client: ACK=1, ack=x+1, SYN=1, seq=y Client → Server: ACK=1, ack=y+1, seq=x+1 Rules: SYN=1 segments cannot carry data but consume one sequence number. Pure ACKs without data do not consume sequence numbers.

4.2 Four-Way Handshake (Connection Termination)

Active closer → Peer: FIN=1, ACK=1, seq=u, ack=v Peer → Active closer: ACK=1, ack=u+1, seq=v Peer → Active closer: FIN=1, ACK=1, ack=u+1, seq=w (after sending remaining data)

Active closer → Peer: ACK=1, ack=w+1, seq=u+1 Rule: FIN=1 consumes one sequence number even without data. The active closer then enters TIME_WAIT for 2×MSL (MSL = Maximum Segment Lifetime, recommended 2 minutes) to handle possible lost final ACK.

Why 2 MSL? If the final ACK is lost, the peer will retransmit FIN; the 2 MSL wait ensures the active closer can respond.

4.3 Keepalive Timer

Detects dead peers on idle connections. If no data for a period, send probe; after several unanswered probes, close connection.

4.4 Half-Connection Queue

When server receives SYN, it enters SYN_RCVD and places the request in a half-connection queue until the handshake completes.

4.5 Why Not Two-Way Handshake?

Delayed duplicate SYN could arrive after the original connection is closed, causing the server to allocate resources for a non-existent connection.

4.6 Why Not Three-Way Termination?

The passive closer may still have data to send; it needs to send its own FIN after finishing, requiring four segments.

4.7 SYN Flood Attack

Server allocates resources at the second handshake (upon receiving SYN), while client allocates at the third. Attacker sends many SYN packets from spoofed IPs; server replies SYN+ACK and waits, filling the half-connection queue, dropping legitimate requests. This is a classic DoS/DDoS attack.

5. How TCP Guarantees Data Correctness

Error Control : Checksum (one's complement sum of header + data + padding). Mismatch → discard segment, no ACK.

Sequencing & Ordering : Every byte numbered; receiver reorders before delivering to application.

ACK + Timeout Retransmission : Sender starts timer per segment; on timeout, retransmits.

Flow Control : Sliding window based on receiver buffer.

Congestion Control : Slow start, congestion avoidance, fast retransmit, fast recovery.

UDP Protocol

UDP header is fixed 8 bytes : source port, destination port, length, checksum.

TCP vs UDP Comparison

1. Connection Model

UDP : Connectionless.

TCP : Connection-oriented (three-way handshake, four-way handshake).

2. Broadcast & Multicast

UDP : Supports one-to-one, one-to-many, many-to-one, many-to-many.

TCP : Only one-to-one.

3. Application Data Handling

UDP : Message-oriented – each application write becomes one UDP datagram.

TCP : Byte-stream – application writes are buffered and segmented by TCP; enables reliability, flow control, congestion control.

4. Reliability

UDP : Unreliable, no guarantee of delivery, order, or duplicate protection. Suitable for real-time apps (VoIP, video conferencing).

TCP : Reliable, in-order, duplicate-free delivery. Suitable for file transfer, email, web.

5. Header Overhead

UDP : 8 bytes fixed.

TCP : Minimum 20 bytes, maximum 60 bytes (with options).