Hello everyone in this video. I'm gonna show you
how TCP works and what is P3 by
handshake is
firstly we will talk about the RC a little
bit. What is the RFC RFC stands
for request for comments. It is a series
of documents that are created and published by
the internet engineering task force ietf to
provide technical specifications and
guidelines for the various protocols and
technologies that make up the
internet and the process of creating RFC is
open and collaborative. And the
goal is to reach a consensus on the
best way to implement a particular protocol or
technology. The goal of an IFC is
to establish a standard that is what accepted
and used by the internet Community. Our FC's
are also assigned a number which is user to
identify the document. For example, the first official
LFC was published in 1969, and
it was given the number RFC one.
The number of the rfcs are incremented as
new documents are published.
Overall the rfcs play a crucial role
in the development and evolution of the
internet. They provide a common understanding
of the protocols and the technologies that
make up the internet and they are
widely used by Engineers researchers and
developers to design Implement and
terrible should systems that use these protocols
and Technologies. So note
that everything I'm gonna tell you here
is based on the RFC document describing the
TCP protocol.
Each detail was prepared with reference
to tcps RFC, which is
RFC 793.
So now let's talk about TCP protocol
and tcp-3 way handshake.
TCP is a transport layer protocol
that provides reliable ordered and error check
delivery of data between applications running
on hosts in a package Network such
as the internet and it is connection-oriented meaning
that a virtual connection must be established between two
and points before data can
be exchanged. This is done using a TV
handshake maybe, you know seen seen
egg and an egg messages, which
is used to establish a connection.
And TCP uses a sliding
window flow control mechanism to regulate the
amount of data that can be sent at
one time this allows to receiving
host to control the amount of data that
the center can transmit and helps to
prevent congestion in the network the receiving host
sense and X message and
egg packet which means acknowledgment for
each block of data that it
receives and descend or maintains a window of
an acknowledged data. So the
size of the window is determined by the receiving
host and can be adjusted based on
network conditions. So TCP
also includes mechanisms some mechanisms
to ensure reliable data transfer such
as retail transmission of lost
packets and detection of
duplicate packets. If a packet is lost or corrupted.
In transit the receiving host will
not send an acknowledgment. The sender
will retransmit the using packet.
So TCP also includes a mechanism
for detecting duplicate packets and
discarding them to prevent confusion.
Now, let's look at how a TCP packet
is according to RFC 793
the TCP RFC.
Now in here each layer or each partition
of a TCP packet has 32
bits in total
32 bits of space a capacity with
32 bits. So the
whole section the first section of
a TCP packet core section is 32
bits in total and the 16
bits of this capacity
belongs to the source port and
the other 16 bits belongs to
the destination Port field. The other
part is so you can number and
the Egg number fields and they
are also represented by 32 bits.
Another important area here is
we can focus on the flags section.
There are some
Flags parameters and maybe you know, which case
the black parameters.
In this section and each flag is
represented by only one
bit. You can see it corresponds
to the only one bit as a
result. Each flag is represented with only
one bit.
As you can see each one corresponds to
the one bit.
Now, let's move on to the Wireshark to investigate a
real TCP packet on our
traffic.
If you want to investigate a tcp-based conversation
while performing TCP analysis, you can
write can make a right click on the
packet.
like this
in this way, you can choose you
can go to the conversation filter and we
are choosing TCP section.
Here we choose TCP because
we want to see the entire TCP conversation
between client and host and
as you can see it brought the whole
conversation between the two IPS.
Between the source IP and
Suite 160.237 and
the destination IP and
Suite 278 and
223.
Thus you will clear all the packets that
come between this conversation and you
will only see the conversation between
the two IPS.
Now, let's go to the packet details.
on this packet on the first packet
We will see the components of TCP.
So as you can see these fields these
components are also in
the TCP packet structure according
to the RFC document.
Just like we have seen in the RFC documents. There
are the TCP components
in here in the pack details
first. We are seeing the source port in here and
it is 3372.
And the destination Port is 80,
which is HTTP port and
the stream index just below.
It ensures that each conversation is
followed as a stream in Wireshark. For
example, since this conversation is the
first conversation in our pickup file. The index
value is seen as zero.
So in this citrine index value of the second
conversation will be 1 thus each
stream is tracked with this index value.
For example, let's say we want to see the next
conversation.
We can use this parameter and
we will hold the string indexed
field.
And drop it to the display filter
field in this way.
So
it will ask to do selected or not
selected. We will choose the selected
option.
as you can see
in here, our filtering expiration
is tcp.stream is equal to
zero.
So we want to get the string.
which has index value 0
now if we set the value to 1
it will bring up the next conversation from
0 to 1.
the TCP stream
value and click on the enter
Here it is as you can see.
We are seeing the TCP conversation with
the stream index value 1.
And this is the second conversation second TCP conversation
in our pickup file.
And as you can see, there is a different tsp conversation
between other two different IPS.
And let's set the index value to 0 again.
and
return to the previous conversation
and click on the first packet.
When we select the sequence number.
And the sequence number row.
Fields we see that they both correspond to
the same values on the packet by
Spain.
If I choose the sequence number field.
It corresponds some bits.
On the packets pane pain as you
can see and if I choose the sequence
number row field.
It is also corresponds to the same field
on the packet by Spain and since the
second number in the TCP header is
a random value. We see a complex number
in here.
And to look at this sequence number row is
the origin of secant number
of value in the packet and it's a
pretty long number since it
will be difficult for us to follow this value. We
may follow the
sequence number field this field
Wireshark simply determines a
relative sequence number
and starts it from zero and this
is a virtual number.
specified by the Wireshark itself
So take a tricking can be done through this
numbering which is much better
readability, but we will
follow the sequence number row than we
are investigating the TCP three-way
handshake and TCP packets.
Now, let's examine the TCP three
way handshake process packet by packet and
comparing vitamin illustration.
That I have made before I have prepared before
in the illustration on the left
side. We have our client machine and on
the right side. We have our host machine just
like in the TCP conversation
in PK file.
Maybe you know.
And the clients IP address and save
it 160.237 just
like in the source IP
in our PCF file are Source IP
is the same and this is
our client.
and the first IP address
And with 228.23.
And actually here the client will
send and HTTP request
to the host on the traffic. However, since
HTTP works with TCP tcp3, very
handshake must be done first and thus
DCP connection must be established. Therefore.
We will see that the three way
handshake takes place before the HTTP request packet
to be transported with the TCP protocol
for three way handshake first
declined sense a
scene packet as you can see
The first packet is a syn packet.
just like in the
PK file the first packet is a scene packet.
And with this packet it says
hey, this is my sequence number.
And save it 79 and 39.
This complex number is my
sequence number.
And say this hey, this is my sequence number.
to inform the host machine
and let's see this packet in Wireshark.
in here
this is our first packet and
this is the
scene packet
as you can see in the first packet the
sequence number and with 79 and
39.
The sequence number values are the same.
with the illustration
then
the host the sends a scene act
packet in response to response the
client.
And since it ends scene and
eight messages together in one packet,
we see these messages as a
single packet on our terrific traffic
as you can see the second packet
is a thin egg packet.
But this packet contains actually two
messages.
as seen and egg messages
So therefore our second packet will
be the one that contains the scene
and egg messages in the
first packet declines set to the
host a this is my sequence number.
Now in the second packet with the scene
message.
The host says hey, this is my second
number to the client.
And it shows its sequence
number as these number
ends with 83 and 79.
And in this way, it reports the initial sequence
number value to the client and to
host also notifies with an X
message that it has received the
sequence number.
That the client has sent to it.
And that is that it has received the same
message.
And it says I acknowledge your
sequence number and I wait
next one is as I specified
in this x number in my X number
the number ends with 79 and
4.
So one edit version of the previous
scene number of the client. The
ACT number is one edit version
of the clients sequence numbers
and
That is what x numbers in sinach
means now. Let's open
the synag packet. The second packet is
you can see in here. The seconds
number is the number ends with
8379 just like
in our illustration.
And H value is the number
ends with 79 and
40 just like
in our illustration.
So with the same act packet the
host sense to messages as
a scene message and an egg
message.
And in sin message, it sends
its thin sequence number and
also it informs that I have
received your sequence number.
This number and I am waiting the
next one as the edit version of it.
This act number ends with
79 and 40.
So it means that the sequence number of the
next packet coming from the client.
To the host will be this number.
In response to this thin egg message from the host. The
client also sends an
egg packet.
Just like in here.
client also sends an egg packet as you
can see and in this message, the client says
technology or sequence number as well.
So and says that the sequence number
of the next packet that the host will send is
this number that ends with
83 and 80?
And it is also added version of the
previous sequence number of the
host as you can see.
And thus it reports the expected sequence
number as the X number,
of course because steps two and three
can be combined in a single packet.
This is called three way
or three message. We can say handshake the
three way handshake has three
steps.
is in here
the first step is a syn packet
from client to the host and the
second step.
With the syntax packet
from host to the client.
And the last step the third step in the
third step the client sends and X message.
So after all TCP connection is now established
as you can see now the client
can send data wire TCP protocol. Let's
say the client will send an HTTP request
packet wire TCP.
and after the tcp3v handshake process the
httpa conversation and
now begins in the packet
4
now click on the packet for and let's look
at the packages in here.
And expand the transmission control protocol TCP
field.
As you can see in here, the sequence
number is the same as the
third packet.
the second number in the
record for
and include 79 and
40 and when we look at
the third packet, it is the same of the packet
for
so the sequence number didn't change
in here.
They are the same.
Because the egg doesn't occupy a sequence
numbers space.
And the sequence number didn't change
in here.
Keep in mind that always the client sends
the data.
in here containing an HTTP request via
TCP
And we see this data.
under the TCP heater as
TCP payload
As you can see at the bottom of TCP field,
there is a TCP payload. And when
we click on the TCP payload, we see
that it corresponds to the HTTP get
request on the packet bytes
pane.
Let me show you the message the
HTTP message when we
look at when we click on the TCP payload, then
we click on the TCP payload.
On the packet details pane. It corresponds to
the HTTP get packet
get message.
in the packet by Spain
you can see it.
And this data is wrapped with TCP heater
in transport layer.
Therefore we see the TCP header
fields in front of
data.
the payload in front of payload data
payload in packet details pane
So who sends the next packet
is the host which has the port
number 80?
as the HTTP port numbers
It's part is 80.
And the host sense this packet to
the client.
as a response and on the
other hand the client told the host
in the previous packet that it was
expecting the sequence number
as
in its acknowledged number and in
here
it says that I am expecting your new sequence
number as this number ends
with 83 and 80.
And then we look at the next packet that
sends by the host. We will
see this number as its sequence
number.
Let's look at this.
As you can see in here the seconds number 8380.
just like
in the previous packet this number is
an X number
you can see in here.
So the client said that and
they think your sequence number as this
number.
And the host sense packet with this
number as sequence number.
on the next packet
as you can see
the second number is the same with the
previous X number.
Remember always that key Point packet sent
with the TCP protocol are called segments. So
segments also carry an X
number, which is the sequence number of the next expected
data.
when the TCP transmits a segment containing data
Puts a copy on a written as
Mission queue and starts a timer
when acknowledgment for that data is received.
The segment is deleted from the queue.
The acknowledgment isn't received before the timer
runs out. This segment is returned method.
So this is how TCP communication is done with
sequence and X numbers. All right.
How is a TCP packet set to
scene packet or scene message
or AC message?
The answer is simple.
This property of the packet is set using TCP
Flex.
So when we look at the scene packet
is in here.
We see that the flags field in
here.
Just like in the TCP structure
according to the RFC document. There
are some flag values. First
one is the Urgent. The second one
is acknowledgment and the other one push
and reset and scene and
Fin.
So, for example, we see that the scene
flag pit value is in here one.
So other flag values are set
to 0.
For example egg is 0 reset
is zero. Fin is
0 only the scene flag is
set to 1.
Because this packet becomes the
scene packet.
And in order to make this packet as
a scene packet, it is set
to the one as bit value.
So how then is setting down in the
thin egg packet, let's look at
this.
And in here because of this packet
is a thin egg packet the acknowledgment
flag is set to
the one and the thin flag
is also set to the one.
It value and the other ones are
0 as well.
So by these values are
set to the 1
the x value and the
scene value. This packet is made as
a thin egg packet.
So this is how TCP protocol works in the network
traffic?
So that's all for this lesson and we will discuss
about the DHCP and net bios and
the curbs on the next lesson. See you
on the next video.