dokucama

User Tools

Site Tools

Trace:
network_stuff:tcpnotes

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
network_stuff:tcpnotes [2021/12/10 12:46] – external edit 127.0.0.1network_stuff:tcpnotes [2024/10/14 12:44] (current) – jotasandoku
Line 8: Line 8:
     * SACK is like a lookeahead acknowledgement while we wait for slow Bytes to arrive.     * SACK is like a lookeahead acknowledgement while we wait for slow Bytes to arrive.
     * Example: "If I received Bytes 1,2,3 5,6 but not 4, I acknowledge 3 and 'selectively acknowledge' 5 and 6."     * Example: "If I received Bytes 1,2,3 5,6 but not 4, I acknowledge 3 and 'selectively acknowledge' 5 and 6."
 +    * How it works in practice: by appending to a duplicate acknowledgment packet a TCP option containing a range of noncontiguous data received
 \\ \\
-ACK is sent __by the SENDER__. Indicating that is has received cumulated data and is ready for the next segment+ACK is sent indicating that is has received cumulated data and is ready for the next segment
 The ACK number for a packet is the packet's sequence number plus the data length. See this for a **full explanation of ack and seq numbers**: [[https://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/|External Link]] The ACK number for a packet is the packet's sequence number plus the data length. See this for a **full explanation of ack and seq numbers**: [[https://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/|External Link]]
  
Line 20: Line 21:
 \\ \\
 The three way handshake implies there are two clients and two servers << The three way handshake implies there are two clients and two servers <<
 +
 +{{:network_stuff:3wayhandshakesimple.png?400|}}
 +
 +
 +
 +----
 +
 +TCP TIMERS:
 +\\
 +  * Time Out Timer: sender waiting for the ack. If ack doesn't arrive, TCP rtx. Value of Time Out Timer adapts depending on  the traffic in the network.
 +  * Time Wait Timer: used for the orderly close and discard or ports at the end of a session. Sender starts the time wait timer after sending the ACK for the second FIN segment.
 +  * Keep Alive Timer: If server stops hearing a customer for 2 hours starts sending 10 probes every 75 seconds.
 +  * Persistent Timer: Used to deal with deal with a zero-widow-size deadlock situation. Keeps sending data for a while even when the receiver has closed the window.
 +
  
 ---- ----
Line 28: Line 43:
 \\ \\
 (Reno, Cubic, Tahoe, more recently, BBR + Vegas, , Westwood) (Reno, Cubic, Tahoe, more recently, BBR + Vegas, , Westwood)
-[[https://medium.com/@atoonk/tcp-bbr-exploring-tcp-congestion-control-84c9c11dc3a9]] +\\ 
 +  * BBR (Bottleneck Bandwidth and RTT). Used in QUIC and HTTP/3 protocols. More modern and **doesn't rely on packet loss**, aiming to maximize throughput by actively **probing network capacity**. It's better suited for modern, high-speed networks. 
 +  * CUBIC (cubic function) is default in Linux. It relies on packet loss and a cubic window growth, making it less aggressive than BBR but well-optimized for traditional networks. 
 +  * BBR offers more efficient bandwidth usage and lower latency, especially in unpredictable networks, while CUBIC is robust in traditional high-speed environments. 
 +  * 
   * sysctl net.ipv4.tcp_congestion_control  # default is usually cubic or reno   * sysctl net.ipv4.tcp_congestion_control  # default is usually cubic or reno
   * sysctl net.ipv4.tcp_available_congestion_control  # list available suites   * sysctl net.ipv4.tcp_available_congestion_control  # list available suites
Line 52: Line 70:
   * **Delayed ACK**: is basically a bet taken by the destination betting 200 - 500 ms, that a new packet will arrive before the delayed ACK timer expires.  Nagle's algorithm effectively only allows one packet to be actively transporting on the network at any given time, this tends to hold back traffic due to the interactions between the Nagle's algorithm and delayed ACKs.   * **Delayed ACK**: is basically a bet taken by the destination betting 200 - 500 ms, that a new packet will arrive before the delayed ACK timer expires.  Nagle's algorithm effectively only allows one packet to be actively transporting on the network at any given time, this tends to hold back traffic due to the interactions between the Nagle's algorithm and delayed ACKs.
     * To disable Delayed ACKs, use the TCP_QUICKACK socket option.      * To disable Delayed ACKs, use the TCP_QUICKACK socket option. 
 +
 +
 +----
 +
 +**FUN FACTS ABOUT TCP**:\\
 +  * reset flag is a rude way of finishing a connection. It can be used by scanners to detect closed/opened ports. Can be sent by the source or destination host, or a network device in transit such as a firewall. Avoids half closed connections due to missed FIN/ACKs etc.
 +    * An attacker in the middle can disrupt the communication between 2 peers.  [[https://robertheaton.com/2020/04/27/how-does-a-tcp-reset-attack-work/|RST_attack]]
 +  * PUSH: is a flag that informs the receiver that all data has been sent. When we disable Nagle with TCP_NODELAY it also sends the push flag but is not exactly the same. [[http://smallvoid.com/article/winnt-tcp-push-flag.html|External Link]]
 +
 +
 +----
 +
 +QUIC NOTES
 +
 +  * You need decryption keys or won't see much [[https://youtu.be/fHBUOlvS3ts]]
 +  * 1 or 0 handshake modes
 +  * Multiplexes hundreds of flows over single connection
 +  * It has a long connection index (each side chooses its counterpart index).
 +  * ^^ allows reuse connection independently underlying protocol (ie IP changes when moving WiFi to 5G)
network_stuff/tcpnotes.1639140374.txt.gz · Last modified: (external edit)

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki