For example, the next packet after the TCP handshake may be a packet from the sender requesting an HTTP webpage.

At this point, the primary purpose of the TCP packets switches over from achieving TCP goals (i.e., establishing a connection) to being a carrier for another protocol. Now the TCP channel between the sender and recipient is initiated. Finally, the sender sends an ACK packet to acknowledge the recipient’s SYN/ACK. The recipient responds with a SYN/ACK packet that expresses their interest as well and acknowledges receipt of the sender’s SYN packet. First, the sender initiates the communication by sending a SYN packet, expressing their interest in connecting.

The steps in the TCP handshake are fairly straightforward, as shown in the screenshot from Wireshark above. Instead, the TCP users first go through the TCP handshake protocol to establish a channel before sending actual data. In TCP, the data intended for the final recipient is never sent in the first packet. A common reason to abuse flags is in scanning since different operating systems have different responses to certain errors. TCP connections and use of flags is very formulaic. Some are intended to be used a set time during the connection (like SYN and FIN), others are used throughout (like ACK) and the rest are used only in unusual scenarios (RST, PSH and URG).

URGent: Process a packet before all other packetsĭifferent types of packets are used at different times within the TCP session.

PuSH: Tells recipient to immediately process a packet (instead of buffering).

ReSeT: Immediately terminates a connection.

ACKnowledgement: Acknowledges receipt of a packet.

Like ICMP types and codes, TCP flags describe the purpose of the packet. One of the primary differentiators between TCP and UDP packet is the use of flags in TCP. A TCP communications channel is set up using the TCP handshake and provides a number of guarantees to the sender and recipient. As a result, a TCP communication is very formalized, using several different types of packets denoted by different TCP flags. TCP differs from other protocols since it is intended to provide reliable data transfer.

View tcp retransmission wireshark