TCP Header Part – 2

TCP Header seq ack

Sequence & Acknowledgement Number

Sequence and acknowledgement fields are another important fields in tcp header.Each of these fields are 32 bits long.

5seq ack - TCP Header Part – 2
Datas generally sent and received with packets larger than MTU. So using sequence and acknowledgement number getting important during this process.

These fields are in the features that make TCP connection oriented. With sequence and acknowledgement numbers, packet reache to the destination without lost. If any of the packet do not reach to the destination, it is known by its sequence number and requested again. This results no loast during the session.

Before data transfer a new TCP connection is created. The host’s first sequence number that is used during starting of the connection is called “Initial Sequence Number(ISN)”.

From the point of security, this is open to the hijacking attacks. It is easy for an hacker to hijack the system. Different operating systems handle sequence and acknowledgement parameters differently. A hacker checks the ISN number and then determines the operating system. After that hijacking is almost completed. He predict the next sequence number and after that the destination do not understand that it is an hacker. Hacker also use flooding towards the sending host in order to be busy. You can check this scenario better with the below picture.

6hijacking - TCP Header Part – 2
Sequence and the acknowledgement numbers are also used to reorder of the packets at the remote node.Because sometimes the packets reaches the destiantion at different times and different order.

Let’s explain these sequence and acknowledgement numbers with the below picture.

7 3wayhandshake requestdata - TCP Header Part – 2
As mentioned above, firstl the TCP 3 way handshake is completed and TCP connection established. After that the data is sent. Think this example as requesting a webpage. Firstly host send a packet with SYN flag set and the sequence number(ISN number) is filled. In the second step the remote node get the apcket and reply it with its own ISN number as a sequence number, and acknowledge the packet come with requesting next one in its ACK value. Be careful, there are two ACK here. One is 3 way handsake ACK and the other is acknowledgement number. One is flag and the other is number.

In the third step, host send the next packet with the next sequence number that remote node has wanted.And it also acknowledge the correct receivement of the packet and request the next one. After this packet received by the remote host, 3 way handshake is completed.

After 3 way handshake completed, host send the data packet with the same sequence and acknowledgement numbers. Because the ACK packet do not change the sequence and acknowledgement number values.

TCP Header Length

TCP header lenght in TCP header is also called “data offset” in some sniffers. It is a 4-bit long field in TCP header. It represents the TCP header length as you can understand from its name.

8headerlength - TCP Header Part – 2
When the packet goes to the receiver, the receiver check its “header length” and after that it understand where the data section begins.

You can reach the TCP Header article series below…

TCP Header Part – 1
TCP Header Part – 2
TCP Header Part – 3
TCP Header Part – 4
TCP Header Part – 5


Leave a Reply