Hacking - The Art of Exploitation, 2nd Edition

Networking 223

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |U|A|P|R|S|F| |
| Offset| Reserved |R|C|S|S|Y|I| Window |
| | |G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

TCP Header Format

Note that one tick mark represents one bit position.

Figure 3.

The sequence number and acknowledgment number are used to maintain

state. The SYN and ACK flags are used together to open connections in a

three-step handshaking process. When a client wants to open a connection

with a server, a packet with the SYN flag on, but the ACK flag off, is sent to

the server. The server then responds with a packet that has both the SYN and

ACK flags turned on. To complete the connection, the client sends back a

packet with the SYN flag off but the ACK flag on. After that, every packet in

the connection will have the ACK flag turned on and the SYN flag turned off.

Only the first two packets of the connection have the SYN flag on, since those

packets are used to synchronize sequence numbers.

SYN packet

SYN on ACK off

seq # = 324808530

ack # = 0

SYN/ACK packet

SYN on ACK on

seq # = 288666267

ack # = 324808531

ACK packet

SYN off ACK on

seq # = 324808531

ack # = 288666268

Client Server