tcp-analysis-based-on-flags.pdfVIP

TCP Analysis Based on Flags Cheng Guang College of Computer Science Engineering Southeast University, Nanjing, P.R.China Introduction ? We have known that, some TCP segments carry data while others are simple acknowledgements for previously received data. Such as, the popular 3- way handshake utilises the SYNs and ACKs available in the TCP to help complete the connection before data is transferred. ? So we can get a conclusion that each TCP segment has a purpose, and this is determined with the help of the TCP flag options, allowing the sender or receiver to specify which flags should be used so the segment is handled correctly by the other end. Flags ? Six Flags ? Urgent Pointer ? ACKnowledgement ? PUSH ? Reset (RST) Flag ? SYNchronisation Flag ? FIN Flag ? All flags, a value of 1 means that a particular flag is set‘. ? Each flag is one bit long, and since there are 6 flags, this makes the Flags section 6 bits in total. 1st Flag - Urgent Pointer ? This flag is used to identify incoming data as urgent‘ ? incoming segments are sent directly and processed immediately. ? An Urgent Pointer could be used during a stream of data transfer where a host is sending data to an application running on a remote machine. ? By setting the abort signals segment Urgent Pointer flag to 1, the remote machine will give that specific segment priority, processing it immediately and stopping all further data processing. The Urgent Pointer ? The urgent pointer flag allows us to mark a segment of data as urgent, while this urgent pointer field specifies where exactly the urgent data ends. ? Urgent Pointer can also be used when attacking remote hosts. 2nd Flag - ACKnowledgement ? The ACKnowledgement flag is used to acknowledge the successful receipt of packets. 3rd Flag - PUSH ? The Push flag ensures that the data is given the priority and is processed at the sending or receiving end. ? This particular flag is used quite frequently at the beginning and end of a d