CompTIA Network+ Preparation · lesson 3 of 30 · 25 min
TCP: Connection-Oriented Transport
TCP (Transmission Control Protocol) operates at Layer 4 (Transport) of the OSI model. It provides reliable, ordered, and error-checked delivery of data between applications.
TCP characteristics: connection-oriented (requires handshake before data), reliable (acknowledgements + retransmission), ordered (sequence numbers), flow control (window size), congestion control.
TCP header fields to know: Source Port, Destination Port, Sequence Number, Acknowledgement Number, Flags (SYN, ACK, FIN, RST, PSH, URG), Window Size, Checksum.
TCP flags:
SYN — synchronise; initiates a connection.
ACK — acknowledgement; confirms receipt.
FIN — finish; gracefully closes a connection.
RST — reset; abruptly terminates a connection (used when a port is closed or a connection is invalid).
PSH — push; tells the receiver to pass data to the application immediately without buffering.
URG — urgent; marks data as urgent (rarely used in modern networks).
The Three-Way Handshake
Before any TCP data is exchanged, a three-way handshake establishes the connection and synchronises sequence numbers between client and server.
Step 1 — SYN: Client sends a TCP segment with the SYN flag set and a random Initial Sequence Number (ISN). “I want to connect; my sequence starts at X.”
Step 2 — SYN-ACK: Server responds with SYN and ACK flags set. It acknowledges the client’s ISN (ACK = client ISN + 1) and sends its own ISN. “I accept; your sequence acknowledged; my sequence starts at Y.”
Step 3 — ACK: Client acknowledges the server’s ISN (ACK = server ISN + 1). Connection is now established and data transfer can begin.
Connection termination (four-way): FIN → ACK → FIN → ACK. Either side can initiate. The TIME_WAIT state keeps the connection open briefly after the final ACK to handle delayed packets.
SYN flood attack: Attacker sends many SYN packets but never completes the handshake. Server allocates resources for each half-open connection until it runs out. Mitigated by SYN cookies.
Exam Tip
The three-way handshake sequence is SYN → SYN-ACK → ACK. Remember: the server always responds with BOTH SYN and ACK in step 2. A SYN flood exploits the half-open connection state.
UDP: Connectionless Transport
UDP (User Datagram Protocol) is also a Layer 4 protocol but is connectionless — no handshake, no acknowledgements, no guaranteed delivery.
UDP characteristics: connectionless (no setup required), unreliable (no retransmission), unordered (no sequence numbers), low overhead (8-byte header vs TCP’s 20+ bytes), fast.
UDP header fields: Source Port, Destination Port, Length, Checksum. That’s it — very simple.
When to use UDP: Applications that can tolerate some loss but need low latency. Examples: DNS (quick queries), DHCP, TFTP, VoIP, video streaming, online gaming, NTP.
TCP vs UDP decision: Need reliability → TCP. Need speed/low latency → UDP. DNS uses UDP for queries (fast) but TCP for zone transfers (reliable).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Network+ — TCP Handshake & UDP
What is the correct order of the TCP three-way handshake?
- ACK → SYN → SYN-ACK
- SYN → SYN-ACK → ACK
- SYN → ACK → SYN-ACK
- SYN-ACK → SYN → ACK
Answer: SYN → SYN-ACK → ACK
Client sends SYN, server replies SYN-ACK, client sends ACK. This establishes the connection and synchronises sequence numbers.
Which TCP flag abruptly terminates a connection?
- FIN
- SYN
- RST
- PSH
Answer: RST
RST (Reset) abruptly terminates a connection — used when a port is closed or a connection is invalid. FIN is a graceful close.
A SYN flood attack exploits:
- The FIN termination process
- Half-open TCP connections that are never completed
- UDP’s lack of acknowledgements
- DNS zone transfers
- Answer: Half-open TCP connections that are never completed
SYN flood: attacker sends SYN but never ACKs. Server holds resources for each half-open connection until exhausted. UDP is preferred over TCP for VoIP because:
- UDP is more reliable
- UDP has lower overhead and latency — some packet loss is acceptable in voice
- UDP supports encryption
- UDP guarantees ordering
- Answer: UDP has lower overhead and latency — some packet loss is acceptable in voice
VoIP needs low latency. A small amount of packet loss causes minor audio glitches — far better than the delay TCP retransmission would cause.
How many bytes is the UDP header?
- 4
- 8
- 20
- 40
Answer: 8
UDP header = 8 bytes (Source Port, Dest Port, Length, Checksum). TCP header is 20+ bytes — UDP’s simplicity is why it’s faster.
DNS uses TCP instead of UDP for:
- All DNS queries
- Zone transfers — large data transfers requiring reliability
- Reverse lookups only
- DNSSEC only
- Answer: Zone transfers — large data transfers requiring reliability
DNS queries use UDP (fast, small). Zone transfers (copying entire DNS zones between servers) use TCP for reliability.
Which TCP flag is set in BOTH step 1 and step 2 of the handshake?
- ACK
- FIN
- SYN
- RST
Answer: SYN
SYN is set in step 1 (client) and step 2 (server SYN-ACK). ACK is set in steps 2 and 3 but not step 1.
TCP connection termination uses how many steps?
- 2
- 3
- 4
- 5
Answer: 4
TCP termination: FIN → ACK → FIN → ACK (four-way). Each side independently closes its half of the connection.
Which protocol uses UDP? (Select the best answer)
- HTTP
- SSH
- DHCP
- FTP
Answer: DHCP
DHCP uses UDP ports 67/68. HTTP, SSH, and FTP all use TCP for reliable delivery.
SYN cookies are used to mitigate _____ flood attacks.
Answer: SYN
SYN cookies allow the server to handle SYN requests without allocating resources until the handshake completes — mitigating SYN flood DoS attacks.
Previous lesson: Common ports and protocols: DNS, DHCP, HTTP/S, FTP, SSH, SMTP, SNMP, RDP
Back to CompTIA Network+ Preparation
Next lesson: DNS record types: A, AAAA, CNAME, MX, PTR, TXT, NS, SOA