TCP Foundations

Start here if you are new to TCP. These are the ideas the lessons build on — the ones that make packet traces readable instead of intimidating. No packet-analysis experience needed; there are no captures on this page at all, just the concepts and a few diagrams. Every lesson links back here.

This page assumes you already know what a layer, an address and a port are. If any of those are new, Networking Foundations covers them first — it is the whole-curriculum version of this page.

Same ideas, three depths — the level applies to the explanations, not just packet notes.

The Internet's basic delivery service is brutally simple: hand it a packet and it will *probably* deliver it, *probably* intact, *possibly* out of order, and *possibly* not at all — with no notification either way. That service is called IP, and almost no application can use it directly. Imagine a postal service that loses letters silently, delivers them in the wrong order, and occasionally delivers two copies. TCP is the layer that sits on top and turns that into something you can actually build on: a connection where everything you send arrives, once, in order.

It is just as important to know what TCP will *not* do for you. Many production bugs come from assuming a guarantee TCP never made.

Connection-oriented: Both sides agree to talk (a handshake) before any data flows, and both keep state about the conversation until it is closed.
Reliable delivery: Every byte you send arrives, or the connection fails loudly. TCP keeps copies and resends what isn't acknowledged.
Ordered delivery: Bytes are handed to the application in the order they were sent, even if they arrived out of order.
Full-duplex: Both directions carry data simultaneously and independently.
Byte-stream service: TCP delivers a stream of bytes, NOT the messages you wrote. Your send() boundaries are not preserved.
Error detection: A checksum over the header and data catches (most) corruption in transit.
Flow control: The receiver can slow the sender down so its buffer never overflows.
Congestion control: The sender restrains itself so the network between the hosts isn't overwhelmed.
Multiplexing via ports: Port numbers let one machine hold many simultaneous conversations, and one server port serve thousands of clients.
NOT provided: message boundaries: Two writes may arrive as one segment, or one write split across several. Frame your own messages.
NOT provided: encryption or authentication: TCP protects against accidents, not adversaries. That is TLS's job.
NOT provided: guaranteed latency or bandwidth: TCP will deliver your data eventually; it cannot promise when or how fast.
NOT provided: protection from application bugs: TCP delivers exactly the bytes you gave it — including wrong ones.

✗ Common misunderstanding: If I send() twice, the other side will recv() twice with the same boundaries.

Why that's wrong: TCP is a byte stream with no message boundaries. Two writes may arrive coalesced in one segment, and one write may be split across several.

Correct model: TCP guarantees the ORDER and completeness of bytes, never their grouping. Applications must frame their own messages (length prefixes, delimiters).

The packets prove it: In the Nagle lesson three separate keystrokes arrive inside ONE segment — the receiver cannot tell where the writes were.

Ready for packets

Everything above shows up in the very first lesson. Start with the header, then watch a connection open — you now have the vocabulary for both.

Lesson 1 — TCP header anatomy →Lesson 2 — the handshake