Open Source Security Tools : Practical Guide to Security Applications part 9. Few frontline system administrators can afford to spend all day worrying about security. But in this age of widespread virus infections, worms, and digital attacks, no one can afford to neglect network defenses. Written with the harried IT manager in mind, Open Source Security Tools is a practical, hands-on introduction to open source security tools. | Page 59 Wednesday June 23 2004 2 59 PM TCP IP Networking SYN ACK - Got your SYN I m ready Originating Node SYN - Are you ready to communicate ACK - Got your ACK I ll start sending 59 Receiving Node Figure TCP Three-Way Handshake and assuming we are using IP addresses and not host names the first thing that happens is that the machine generates an ARP Address Resolution Protocol request to find the corresponding Ethernet address to the IP it is trying to communicate with. ARP converts an IP address into a MAC address on an Ethernet network. Now that we can communicate to the machine using IP there is a three-way communication between the machines using the TCP protocol to establish a session. A machine wishing to send data to another machine sends a SYN packet to synchronize or initiate the transmission. The SYN packet is basically saying Are you ready to send data If the other machine is ready to accept a connection from the first one it sends a SYN ACK which means Acknowledged I got your SYN packet and I m ready. Finally the originating machine sends an ACK packet back saying in effect Great I ll start sending data. This communication is called the TCP three-way handshake. If any one of the three doesn t occur then the connection is never made. While the machine is sending its data it tags the data packets with a sequence number and acknowledges any previous sequence numbers used by the host on the other end. When the data is all sent one side sends a FIN packet to the opposite side of the link. The other side responds with a FIN ACK and then the other side sends a FIN which is responded to with a final FIN ACK to close out that TCP IP session. Because of the way TCP IP controls the initiation and ending of a session TCP IP communications can be said to have state which means that you can tell what part of the dialogue is happening by looking at the packets. This is a very important for firewalls because the most common way for a firewall to .
