{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/tcp-ip","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/tcp-ip/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/tcp-ip/"},"term":{"en":"TCP/IP","da":"TCP/IP"},"aka":{"en":["Internet protocol suite"],"da":["internetprotokolfamilien"]},"domain":["cs"],"cluster":"networking","layer":"network","status":"current","era":1974,"summary":{"en":"The family of protocols that the internet and most other networks use to address, send and deliver data.","da":"Den familie af protokoller, som internettet og de fleste andre netværk bruger til at adressere, sende og levere data."},"body":{"formal":{"en":"A layered suite of protocols in which IP moves packets between IP addresses across networks, and TCP on top of it delivers a reliable, ordered stream of data between ports.","da":"En lagdelt samling protokoller, hvor IP flytter pakker mellem IP-adresser på tværs af netværk, og TCP ovenpå sørger for en pålidelig, ordnet strøm af data mellem porte."},"plain":{"en":"IP is the post office that moves envelopes; TCP is the careful clerk who numbers them, checks every one arrived, and asks again for any that went missing.","da":"IP er postvæsenet, der flytter kuverterne; TCP er den omhyggelige ekspedient, der nummererer dem, tjekker at alle er kommet frem, og beder om dem, der mangler."},"inPractice":{"en":"When the online exam system at an upper-secondary school keeps freezing, the school's IT manager records the network traffic and sees TCP resending many lost packets between the students' laptops and the server - pointing to a faulty wireless access point.","da":"Da eksamenssystemet på et gymnasium bliver ved med at fryse, optager skolens IT-ansvarlige netværkstrafikken og ser TCP sende mange tabte pakker igen mellem elevernes bærbare og serveren - et tegn på et defekt trådløst adgangspunkt."},"whyItMatters":{"en":"It is the shared language of nearly every network, so firewall rules, logs and many attacks are all described in its terms.","da":"Det er det fælles sprog for næsten alle netværk, så firewallregler, logs og mange angreb beskrives alle i dets begreber."}},"deepDive":{"en":"Vint Cerf and Bob Kahn described the design in \"A Protocol for Packet Network Intercommunication\" (IEEE Transactions on Communications, May 1974), originally as a single Transmission Control Program. It was later split into IP, which handles addressing and forwarding, and TCP, which handles reliable delivery end to end, so that applications not needing reliability could run directly over IP; UDP (RFC 768, 1980) fills that role. IP (RFC 791) and TCP (RFC 793) were published in 1981, ARPANET switched over on 1 January 1983, and RFC 1122 and RFC 1123 (1989) set out host requirements. The consolidated TCP specification is now RFC 9293 (2022), which obsoletes RFC 793.\n\nThe suite is usually described in four layers: link, internet (IP and ICMP), transport (TCP, UDP) and application. TCP opens a connection with a three-way handshake (SYN, SYN-ACK, ACK) in which each side picks an initial sequence number; sequence numbers are 32-bit and count bytes, and acknowledgements are cumulative. Initial sequence numbers must be unpredictable (RFC 6528), because predictable ones allowed blind spoofing and session injection, famously used by Kevin Mitnick in 1994. Flow control uses the receiver's advertised window, a 16-bit field extended by the window scale option (RFC 7323). Lost segments are recovered by retransmission timeouts (RFC 6298), fast retransmit after three duplicate ACKs and selective acknowledgements (SACK, RFC 2018). Congestion control (RFC 5681) combines slow start and congestion avoidance; CUBIC (RFC 9438) is the Linux default, and BBR is an alternative model-based algorithm. Connections close with FIN exchanges, and the side that closes first waits in TIME-WAIT for twice the maximum segment lifetime; RST aborts a connection immediately.\n\nUDP adds only ports, a length and a checksum in an 8-byte header, and is used where latency matters more than retransmission, or where the application handles reliability itself: DNS, VoIP and QUIC. QUIC (RFC 9000) runs over UDP and implements streams, loss recovery and congestion control in user space with TLS 1.3 built in, avoiding TCP's head-of-line blocking; because most of its header is encrypted, middleboxes see far less than with TCP.\n\nThe symptoms in the school example are typical of what packet analysis reveals: retransmissions, duplicate ACKs, zero-window advertisements and unexpected RSTs point respectively to loss, receiver overload or middleboxes killing connections. Security mechanisms and attacks are expressed in the same terms. SYN floods exhaust half-open connection state (mitigated by SYN cookies, RFC 4987), off-path RST injection is made harder by the challenge-ACK rules of RFC 5961, and tools such as Nmap and p0f fingerprint operating systems from initial TTL, window size and the order of TCP options.","da":"Vint Cerf og Bob Kahn beskrev designet i \"A Protocol for Packet Network Intercommunication\" (IEEE Transactions on Communications, maj 1974), oprindeligt som ét samlet Transmission Control Program. Det blev senere delt i IP, der står for adressering og videresendelse, og TCP, der sørger for pålidelig levering fra ende til ende, så applikationer uden behov for pålidelighed kunne køre direkte over IP; UDP (RFC 768, 1980) udfylder den rolle. IP (RFC 791) og TCP (RFC 793) blev udgivet i 1981, ARPANET skiftede over den 1. januar 1983, og RFC 1122 og RFC 1123 (1989) fastlagde kravene til værter. Den samlede TCP-specifikation er i dag RFC 9293 (2022), som afløser RFC 793.\n\nProtokolfamilien beskrives normalt i fire lag: link, internet (IP og ICMP), transport (TCP, UDP) og applikation. TCP åbner en forbindelse med et trevejshåndtryk (SYN, SYN-ACK, ACK), hvor hver side vælger et startsekvensnummer; sekvensnumre er på 32 bit og tæller byte, og kvitteringer (ACK) er kumulative. Startsekvensnumre skal være uforudsigelige (RFC 6528), fordi forudsigelige numre muliggjorde blind spoofing og indsprøjtning i sessioner - berømt udnyttet af Kevin Mitnick i 1994. Flowkontrol bruger modtagerens annoncerede vindue, et 16-bit felt, der udvides med window scale-optionen (RFC 7323). Tabte segmenter genoprettes via retransmission efter timeout (RFC 6298), fast retransmit efter tre dublerede ACK'er og selektive kvitteringer (SACK, RFC 2018). Trængselskontrol (RFC 5681) kombinerer slow start og congestion avoidance; CUBIC (RFC 9438) er standard på Linux, og BBR er en alternativ, modelbaseret algoritme. Forbindelser lukkes med udveksling af FIN, og den side, der lukker først, venter i TIME-WAIT i to gange den maksimale segmentlevetid; RST afbryder en forbindelse øjeblikkeligt.\n\nUDP tilføjer kun porte, en længde og en checksum i en header på 8 byte og bruges, hvor lav forsinkelse betyder mere end genudsendelse, eller hvor applikationen selv sørger for pålidelighed: DNS, VoIP og QUIC. QUIC (RFC 9000) kører over UDP og implementerer streams, genopretning efter tab og trængselskontrol i brugerrummet med TLS 1.3 indbygget, så man undgår TCP's head-of-line blocking; fordi det meste af headeren er krypteret, ser mellemliggende udstyr langt mindre end ved TCP.\n\nSymptomerne i eksemplet med gymnasiet er typiske for det, pakkeanalyse afslører: Retransmissioner, dublerede ACK'er, annonceringer af nul-vindue og uventede RST'er peger på henholdsvis tab, en overbelastet modtager eller mellemliggende udstyr, der afbryder forbindelser. Sikkerhedsmekanismer og angreb beskrives i de samme begreber. SYN-flood-angreb opbruger tilstanden for halvåbne forbindelser (modvirkes med SYN cookies, RFC 4987), indsprøjtning af RST udefra gøres sværere af challenge-ACK-reglerne i RFC 5961, og værktøjer som Nmap og p0f genkender styresystemer ud fra start-TTL, vinduesstørrelse og rækkefølgen af TCP-options."},"edges":[{"type":"requires","to":"cs/ip-address","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/packet","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/port","confidence":"high","strength":"normal"},{"type":"kind-of","to":"cs/protocol","confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"},{"title":"RFC 9293 - Transmission Control Protocol","tier":"standard"}],"draft":true}