Que evento de três vias ocorre na camada de transporte durante o handshake?

Flags são nada mais do que bits em um pacote TCP. Por exemplo, é convencionado que 2 bits são, respectivamente, as flags ACK e SYN. Se você recebe um pacote e esses bits são 10 então esse pacote tem a flag ACK ativa, se eles são 11 então o pacote é SYN/ACK, e assim por diante (o TCP tem mais flags além dessas duas, como FIN e RST).

Origem: Wikipédia, a enciclopédia livre.

Handshake ou aperto de mão é o processo pelo qual duas ou mais máquinas afirmam que reconheceram umas às outras e estão prontas para iniciar a comunicação. O handshake é utilizado em protocolos de comunicação, tais como: FTP, TCP, HTTP, SMB,SMTP,POP3 etc.

Assim você consegue fazer uma conexão entre duas ou mais máquinas só esperando o serviço a ser disponibilizado.

handshake triplo:

Um handshake triplo é necessário porque os números de sequência não são vinculados a um relógio global na rede e os protocolos TCP podem ter mecanismos diferentes para captar o ISN (Initial Sequence Number). O receptor do primeiro SYN não tem meios para saber se este é um segmento antigo atrasado, a menos que tenha registrado o último número de seqüência usado na conexão. Nem sempre é possível lembrar esse número. Assim, o receptor deve pedir ao remetente que verifique esse SYN.

O host (A) inicia uma conexão enviando um pacote SYN para o host (B) indicando que o seu ISN = X: A —> B SYN, seq de A = X

B recebe o pacote, grava que a seq de A = X, responde com um ACK de X + 1, e indica que seu ISN = Y. O ACK de X + 1 significa que o host B já recebeu todos os bytes até ao byte X e que o próximo byte esperado é o X + 1: B —> A ACK, seq de A = X, SYN seq de B = Y, ACK = X + 1

A recebe o pacote de B, fica sabendo que a sequência de B = Y, e responde com um ACK de Y + 1, que finaliza o processo de estabelecimento da conexão: A —> B ACK, seq de B = Y, ACK = Y + 1

Skip to main content

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Explanation of the three-way handshake via TCP/IP

• Article
• 09/24/2021
• 11 minutes to read

In this article

This article discusses the Transmission Control Protocol (TCP) three-way handshake process between a client and server when starting or ending a TCP connection.

Applies to:   Windows Server 2012 R2
Original KB number:   172983

Summary

This article is intended for audiences who are familiar with Transmission Control Protocol/Internet Protocol (TCP/IP). It discusses the process of the TCP three-way handshake between a client and server when starting or ending a TCP connection.

More information

The TCP level of the TCP/IP transport protocol is connection-oriented. Connection-oriented means that, before any data can be transmitted, a reliable connection must be obtained and acknowledged. TCP level data transmissions, connection establishment, and connection termination maintain specific control parameters that govern the entire process. The control bits are listed as follows:

URG: Urgent Pointer field significant
ACK: Acknowledgment field significant
PSH: Push Function
RST: Reset the connection
SYN: Synchronize sequence numbers
FIN: No more data from sender

There are two scenarios where a three-way handshake will take place:

• Establishing a connection (an active open)

• Ending a connection (an active close)

The following sample information was obtained from a Network Monitor capture. Network Monitor is a protocol analyzer that can be obtained from Microsoft Systems Management Server.

Establishing a connection

The following sequence shows the process of a TCP connection being established:

Frame 1:

As you see in the first frame, the client, NTW3, sends a SYN segment (TCP ....S.). It's a request to the server to synchronize the sequence numbers. It specifies its initial sequence number (ISN). The ISN is incremented by 1 (8221821+1=8221822), and is sent to the server. To start a connection, the client and server must synchronize each other's sequence numbers. There's also an option for the Maximum Segment Size (MSS) to be set, which is defined by the length (len: 4). This option communicates the MSS the sender wants to receive. The Acknowledgment field (ack: 0) is set to zero because it's the first part of the three-way handshake.

Frame 2:

As you see in the second frame, the server, BDC3, sends an ACK and SYN segment (TCP .A..S.). In this segment, the server is acknowledging the request of the client for synchronization. Meanwhile, the server is also sending its request to the client for synchronization of its sequence numbers. There's one major difference in this segment. The server transmits an acknowledgment number (8221823) to the client. The acknowledgment is just proof to the client that the ACK is specific to the SYN the client initiated. The process of acknowledging the client's request allows the server to increment the client's sequence number by one and uses it as its acknowledgment number.

Frame 3:

As you see in the third frame, the client sends an ACK segment (TCP .A....). In this segment, the client is acknowledging the request from the server for synchronization. The client uses the same algorithm the server implemented in providing an acknowledgment number. The client's acknowledgment of the server's request for synchronization completes the process of establishing a reliable connection and the three-way handshake.

Ending a connection

Although the three-way handshake only requires three packets to be transmitted over our networked media, the termination of this reliable connection needs to transmit four packets. Because a TCP connection is full-duplex (data can flow in each direction independent of the other), each direction must be terminated independently.

Frame 4:

In this session of frames, you see the client sending a FIN that's accompanied by an ACK (TCP .A...F). This segment has two basic functions. First, when the FIN parameter is set, it will inform the server that it has no more data to send. Second, the ACK is essential in identifying the specific connection they've established.

Frame 5:

In this frame, you don't see anything special except for the server acknowledging the FIN that was transmitted from the client.

Frame 6:

After receiving the FIN from the client computer, the server will ACK. Even though TCP has established connections between the two computers, the connections are still independent of one another. So the server must also transmit a FIN (TCP .A...F) to the client.

Frame 7:

The client responds in the same format as the server, by ACKing the server's FIN and incrementing the sequence number by 1.

The client ACKing the FIN notification from the server identifies a graceful close of a TCP connection.

References

Obtain RFC 793.

RFCs may be obtained through the Internet as follows:

Paper copies of all RFCs are available from the NIC, either individually or on a subscription basis (for more information contact ). Online copies are available through FTP or Kermit from NIC.DDN.MIL as rfc/rfc####.txt or rfc/rfc####.PS (#### is the RFC number without leading zeros).

O que é o handshake triplo?

Como ocorre o processo de 3 way handshake no protocolo TCP?

Quais pacotes estão envolvidos no handshake de três vias é qual a ordem em que eles ocorrem?

Como funciona o handshake?