The Transport Layer (Layer 4) provides process-to-process communication between applications using port numbers. It dictates whether data transmission is reliable and stateful (TCP) or lightweight and best-effort (UDP).
1. Port Numbers & Sockets
A Socket is the combination of an IP address and a Port number (e.g., 192.168.1.50:443). Ports are 16-bit integers ranging from 0 to 65535, categorized into three ranges:
- Well-Known Ports (0 – 1023): Reserved for system and standard services (e.g., HTTP: 80, HTTPS: 443, SSH: 22, DNS: 53, SMTP: 25).
- Registered Ports (1024 – 49151): Vendor and user-registered services (e.g., MySQL: 3306, RDP: 3389, PostgreSQL: 5432).
- Dynamic / Ephemeral Ports (49152 – 65535): Temporary client-side source ports assigned dynamically by the OS for outbound sessions.
2. TCP (Transmission Control Protocol) Header & Mechanics
TCP (RFC 793) is connection-oriented, reliable, and provides ordered byte-stream delivery with flow control and congestion management.
4 bits
6 bits
U A P R S F
16 bits
The 6 Core TCP Control Flags
| Flag | Name | Operational & Cybersecurity Role |
|---|---|---|
| SYN | Synchronize | Initiates a TCP connection and synchronizes initial sequence numbers (ISN). Target of SYN Flood attacks. |
| ACK | Acknowledgment | Confirms receipt of data or a SYN/FIN packet. Present in almost all packets after the initial SYN. |
| FIN | Finish | Gracefully terminates a connection; sender has finished sending data. |
| RST | Reset | Abruptly aborts a connection. Sent when a packet arrives for a closed port, or injected by attackers to kill connections. |
| PSH | Push | Instructs the receiving OS to push buffered data immediately to the application without waiting for buffers to fill. |
| URG | Urgent | Indicates that data pointed to by the Urgent Pointer field should be prioritized. |
3. The TCP 3-Way Handshake & 4-Way Teardown
CLIENT SERVER
| |
| 1. [SYN] Seq = X | (Client requests connection)
|------------------------------------------------->| State: SYN_SENT -> SYN_RECEIVED
| |
| 2. [SYN, ACK] Seq = Y, Ack = X + 1 | (Server acknowledges and sends its ISN)
|<-------------------------------------------------| State: SYN_RECEIVED
| |
| 3. [ACK] Seq = X + 1, Ack = Y + 1 | (Client acknowledges server)
|------------------------------------------------->| State: ESTABLISHED on both sides
| |
| === [Data Transfer: Bi-directional Streams] === |
| |
| 4. [FIN] Seq = X + N | (Client initiates graceful close)
|------------------------------------------------->|
| 5. [ACK] Ack = (X + N) + 1 | (Server acknowledges close)
|<-------------------------------------------------|
| 6. [FIN] Seq = Y + M | (Server closes its end)
|<-------------------------------------------------|
| 7. [ACK] Ack = (Y + M) + 1 | (Client final ACK; enters TIME_WAIT)
|------------------------------------------------->|Attacker (SYN Flood DoS): Floods a web server with thousands of spoofed SYN packets without sending the final ACK. The server allocates TCB (Transmission Control Block) memory in its half-open connection backlog table, quickly exhausting RAM and denying service to legitimate clients.
Defender (SYN Cookies): The server does not allocate memory for half-open sockets. Instead, it encodes the connection parameters, client IP/port, and a cryptographic timestamp directly into the 32-bit Initial Sequence Number (ISN) of the SYN-ACK packet. Only when the client returns the valid ACK containing ISN + 1 does the server verify the hash and allocate socket memory.
4. UDP (User Datagram Protocol) & Amplification Attacks
UDP (RFC 768) is a lightweight, connectionless protocol with minimal 8-byte header overhead (Source Port, Destination Port, Length, Checksum). It offers zero guarantees for delivery, ordering, or duplicate protection.
- Common Use Cases: DNS (53), DHCP (67/68), NTP (123), SNMP (161), VoIP, video streaming, online gaming.
Because UDP is completely connectionless and performs no handshake, an attacker can trivially forge the Source IP address in UDP packet headers.
The Attack: The attacker sends small DNS or NTP queries (e.g., 64 bytes) to misconfigured open resolvers across the Internet with the Victim's IP spoofed as the Source IP. The open servers generate huge responses (e.g., 4000+ bytes for DNS ANY queries, an amplification factor of 50x to 100x), inundating the victim's network link with gigabits of unsolicited traffic.