CAP7001 · Unit 5: Transport layer
TCP and the three-way handshake
10 practice questions · in the ETE syllabus
Key points
- Handshake is SYN, SYN+ACK, ACK
- Minimum header is 20 bytes; Data Offset counts 4-byte words
- SYN and FIN each consume one sequence number
- Acknowledgments are cumulative: next byte expected
- SYN cookies defend against SYN floods
TCP provides a reliable, ordered, connection-oriented byte stream. The header is 20 bytes without options, and the Data Offset field counts 4-byte words, so a value of 7 means 28 bytes.
Three-way handshake: the client sends SYN with its initial sequence number (ISN), the server replies SYN+ACK with its own ISN and an acknowledgment of client ISN + 1, and the client sends ACK. ISNs are chosen unpredictably to avoid confusion with delayed old segments and to resist spoofing.
Sequence rules. Sequence numbers count bytes and are 32 bits, wrapping modulo 2^32. SYN and FIN each consume one sequence number, a pure ACK consumes none, and the acknowledgment number is the next byte expected. Acks are cumulative.
Worked example: client ISN 1000. The SYN uses 1000, so data starts at 1001. After 300 bytes the server acknowledges 1301. If segments at 1000, 1500 and 2000 are sent and the 1500 segment is lost, every ack asks for 1500.
Termination normally takes four steps: FIN, ACK, FIN, ACK. A FIN after ISN 100 and 50 data bytes carries sequence 151 and is acknowledged with 152.
A SYN flood fills the half-open queue with spoofed SYNs; SYN cookies avoid storing state by encoding it in the server's ISN.
Exam trap: forgetting that SYN and FIN use up a sequence number.
Try two questions
A client has ISN 100, completes the handshake, sends 50 bytes of data and then sends a FIN. What sequence number does the FIN carry and what acknowledgment does the server return?
- FIN seq 150 and ACK 151
- FIN seq 151 and ACK 151
- FIN seq 150 and ACK 152
- FIN seq 151 and ACK 152
Show the answer
D. SYN uses 100, data uses 101 to 150, the FIN is at 151, and its acknowledgment is 152.
Why not A: That forgets that the SYN used number 100.
Why not B: The FIN itself uses one number, so the ack is one higher.
Why not C: The FIN follows the data at 151, not 150.
A client sends SYN with ISN 1000 and the server answers with ISN 5000. The client then sends 300 data bytes in its first data segment. What acknowledgment number does the server send for them?
- 1301
- 1300
- 1001
- 5301
Show the answer
A. The data occupies 1001 to 1300, so the next expected byte is 1301.
Why not B: The SYN uses 1000, so the data starts at 1001 and ends at 1300.
Why not C: That is the ack for the SYN only.
Why not D: That mixes the server's sequence space with the client's.