External Links

Excellent Tutorial - http://www.ssfnet.org/Exchange/tcp/tcpTutorialNotes.html

Windows Implementation of TCP - http://msdn.microsoft.com/en-us/library/ms819768.aspx

TCP on Wikipedia - http://en.wikipedia.org/wiki/Transmission_Control_Protocol

The TCP Diagram - http://www.daemon.org/tcp.html

Tools

tcptrace - http://www.tcptrace.org/index.html

wireshark - http://www.wireshark.org/

aircrack-ng - http://www.aircrack-ng.org/downloads.html

Flags

Congestion Window Reduced (CWR)

ECN-Echo - Echo the request?

Urgent - Sent out-of-band*

Acknowledgement - Acknowledge receipt of a specific packet

Push - Force delivery

Reset - Abort

Syn - Initialize

Fin - Finished, Good-bye

From Microsoft Support:

• A, ACK- (Acknowledge) The receiver will send an ACK that equals the senders sequence number plus the Len, or amount of data, at the TCP layer. 
• SYN, and FIN flags count as 1 byte. The ACK can also be thought of as the sequence number of the next octet the receiver expects to receive. 
• S, SYN- Synchronize is used during session setup to agree on initial sequence numbers. Sequence numbers are random. 
• F, FIN- Finish is used during a graceful session close to show that the sender has no more data to send. 
• R, RST- Reset is an instantaneous abort in both directions (abnormal session disconnection). 
• P, PSH- Push forces data delivery without waiting for buffers to fill. This is used for interactive traffic. The data will also be delivered to the application on the receiving end with out buffering. 
• U, URG- Urgent- Data is sent out of band.  

Acknowledgement Number Example

The sequence number in frame 51 is 349349990. The ack in frame 57 is 349358750. This is the sequence number from frame 51 plus the amount of data received in frames 51 through 56 (6 frames x 1460 =8760)

When to use Push? When you want to force the read to return without waiting for the buffer to fill.

How long does the server wait to Acknowledge it received data? http://www.faqs.org/rfcs/rfc2581.html

SACK

http://www.ietf.org/rfc/rfc2018.txt

http://msdn.microsoft.com/en-us/library/ms819768.aspx

*In computer networking, out-of-band data (called "urgent data" in TCP) looks to the application like a separate stream of data from the main data stream. This can be useful for separating two different kinds of data. Note that just because it is called "urgent data" does not mean that it will be delivered any faster or with higher priority than data in the in-band data stream. Also beware that unlike the main data stream, the out-of-band data may be lost if the application cannot keep up with it.

Troubleshooting

http://episteme.arstechnica.com/eve/forums/a/tpc/f/469092836/m/870004156731

Books

http://www.pearsonhighered.com/educator/product/TCPIP-Illustrated-Volume-1-The-Protocols/9780201633467.page