TCP/IP

Vint Cerf and Bob Kahn described the design in "A Protocol for Packet Network Intercommunication" (IEEE Transactions on Communications, May 1974), originally as a single Transmission Control Program. It was later split into IP, which handles addressing and forwarding, and TCP, which handles reliable delivery end to end, so that applications not needing reliability could run directly over IP; UDP (RFC 768, 1980) fills that role. IP (RFC 791) and TCP (RFC 793) were published in 1981, ARPANET switched over on 1 January 1983, and RFC 1122 and RFC 1123 (1989) set out host requirements. The consolidated TCP specification is now RFC 9293 (2022), which obsoletes RFC 793.

The suite is usually described in four layers: link, internet (IP and ICMP), transport (TCP, UDP) and application. TCP opens a connection with a three-way handshake (SYN, SYN-ACK, ACK) in which each side picks an initial sequence number; sequence numbers are 32-bit and count bytes, and acknowledgements are cumulative. Initial sequence numbers must be unpredictable (RFC 6528), because predictable ones allowed blind spoofing and session injection, famously used by Kevin Mitnick in 1994. Flow control uses the receiver's advertised window, a 16-bit field extended by the window scale option (RFC 7323). Lost segments are recovered by retransmission timeouts (RFC 6298), fast retransmit after three duplicate ACKs and selective acknowledgements (SACK, RFC 2018). Congestion control (RFC 5681) combines slow start and congestion avoidance; CUBIC (RFC 9438) is the Linux default, and BBR is an alternative model-based algorithm. Connections close with FIN exchanges, and the side that closes first waits in TIME-WAIT for twice the maximum segment lifetime; RST aborts a connection immediately.

UDP adds only ports, a length and a checksum in an 8-byte header, and is used where latency matters more than retransmission, or where the application handles reliability itself: DNS, VoIP and QUIC. QUIC (RFC 9000) runs over UDP and implements streams, loss recovery and congestion control in user space with TLS 1.3 built in, avoiding TCP's head-of-line blocking; because most of its header is encrypted, middleboxes see far less than with TCP.

The symptoms in the school example are typical of what packet analysis reveals: retransmissions, duplicate ACKs, zero-window advertisements and unexpected RSTs point respectively to loss, receiver overload or middleboxes killing connections. Security mechanisms and attacks are expressed in the same terms. SYN floods exhaust half-open connection state (mitigated by SYN cookies, RFC 4987), off-path RST injection is made harder by the challenge-ACK rules of RFC 5961, and tools such as Nmap and p0f fingerprint operating systems from initial TTL, window size and the order of TCP options.