Learn network fundamentals to have cutting-edge skills and hands-on experience to excel in any DevOps role.

DevOps for Developers

Learn network fundamentals essential for any DevOps specialist. You'll explore socket programming, command-line tools, OSI layer protocols, and more.

Network Fundamentals

A TCP connection is established by using a **three-way handshake**, which we briefly touched upon in a previous lesson. The connection establishment phase uses the **sequence number**, the **acknowledgment number**, and the **SYN flag**. 

# Initiating a Connection
When a client host wants to **open a TCP connection** with a server host, it creates and sends a TCP segment with:

- The *SYN* flag set
- The sequence number set to a random initial value. So the sequence numbers **do not start with 0**! Can you guess why?


Why sequence numbers are set to random values


### TCP Sequence Prediction Attack

> <span style="font-size:2.7rem;width:100%;">☠️ </span> **Security Warning: TCP Sequence Prediction Attack** Consider the following scenario: A remote server allows password-less root access to a client based on the client's IP address. So the client would just have to connect to the server and it would be granted privileged access. Let's call this client '**A**'. 
> 1. A malicious entity could masquerade as **A** by faking **A**'s IP address (yes, IP addresses can be spoofed) and initiating a TCP connection with a *SYN* packet.
> 2.  The server would think that **A** started the connection and would respond by sending a *SYN/ACK* to **A**. 
> 3.  Since the malicious entity can’t receive the server’s responses it will have to predict the sequence number. If the initial sequence number was always a fixed value, the malicious entity will be able to send an ACK with the correct acknowledgement number in the last packet based on the starting sequence number the server would use and so would send it in an ACK. 
> 4. The malicious entity has successfully gained unauthorized privileged access to a server by establishing a TCP connection based on a predicted sequence number. This type of attack is called a **TCP Sequence Prediction Attack**. 
If the initial sequence number was fixed, a malicious entity could establish connections, predict the sequence number of a future packet and successfully send a counterfeit packet, fooling the receiving end into believing the packet was sent from the actual sender!



# Responding to an Initial Connection Message
Upon reception of this segment (which is often called a *SYN* segment),  the server host replies with a segment containing:

- the ***SYN* flag** set
- the *sequence number* set to a random number.
- The ***ACK* flag** set
- The **acknowledgment number** set to the sequence number of the received *SYN* segment incremented by 1 mod $2^{32}$, because the *SYN* segment consumes one byte. This new number may exceed $2^{32}$, which is the limit of the *ACK* header field, so the modulus by $2^{32}$ of this number is taken. This allows the number to cycle back and start from $0$. 

>  **Note** When a TCP entity sends a segment with $x+1$ as the acknowledgment number, it means that it has received all the segments up to and including the segments with the sequence number $x$, and that it's expecting data having sequence number $x+1$.

This segment is often called a *SYN+ACK* segment. The acknowledgment confirms to the client that the server has correctly received the SYN segment. The random sequence number of the *SYN+ACK* segment is used by the server host to verify that the client has received the segment.   

# Acknowledging The Response

Upon reception of the *SYN+ACK* segment, the client host replies with a segment containing:

- The ***ACK* flag** set
- The **acknowledgment number** set to the sequence number of the received *SYN+ACK* segment incremented by 1. The modulus of the number by $2^{32}$ is obviously taken. At this point, the TCP connection is open and both the client and the server are allowed to send TCP segments containing data. This is illustrated in the figure below:

In this lesson, we'll discuss how a TCP connection is established!

TCP Connection Establishment: Three-way Handshake

Initiating a Connection