What Is This?

This graph shows an approximation to the Host Transition

System of the TCP specification

TCP, UDP, and Sockets: rigorous and experimentally-

validated behavioural specification. Volume 1: Overview.
Volume 2: The Specification. Steven Bishop, Matthew Fair-
bairn, Michael Norrish, Peter Sewell, Michael Smith, and Keith

TCP: an approximation to the real state diagram Wansbrough. 2005.

The states are the classic ‘TCP states’, though note that
these are only a tiny part of the protocol endpoint state, in
the specification or in implementations. The transitions are
an over-approximation to the set of all the transitions in the
model which (1) affect the TCP state of a socket, and/or
(2) involve processing segments from the host’s input queue
or adding them to its output queue, except that transitions
involving ICMPs are omitted, as are transitions arising from
close_8
close())
the pathological BSD behaviour in which arbitrary sockets can
recv:
send: be moved to LISTEN states. Transitions are labelled by their
Host LTS rule name (e.g. socket 1 , deliver in 3 , etc.), any
socket call involved (e.g. close()), and constraints on the flags
shutdown_1
of any TCP segment received and sent, with e.g. R indicating
deliver_in_1b deliver_in_7b
LISTEN shutdown()
recv:
recv: r recv: R NONEXIST that RST is set and r indicating RST is clear. Transitions in-
send: Rs send:
send:
bad recv segment volving segments (either inbound or outbound) with RST set
are coloured orange; others that have SYN set are coloured
green; others that have FIN set are coloured blue; others are
coloured black. The FIN indication includes the case of FINs
close_7 close_7 close_8
close()
deliver_in_1
recv: arS
close() close() that are constructed by reassembly rather than appearing in a
recv: recv: recv:
send: ArSf
send:
there is another socket in state LISTEN
send: send:
states on the incomplete connection queue
literal segment.
The graph is based on data extracted manually from the
HOL specification. The data does not capture all the invari-
ants of the model, so some depicted transitions may not be
deliver_in_2
recv: arS
reachable in the model (or in practice). Similarly, the con-
send: ArSf
straints on flags shown may be overly weak.

connect_4 deliver_in_2a deliver_in_7c deliver_out_1 deliver_out_1 timer_tt_rexmtsyn_1 timer_tt_keep_1

close_8
deliver_in_3c deliver_in_8 deliver_out_1 deliver_out_1 timer_tt_rexmt_1 timer_tt_persist_1 timer_tt_keep_1
Transition Rules
SYN_SENT recv:
send:
recv: r
send: Rs
recv: R
send:
recv:
send: rsf
recv:
send: rsF
recv:
send: arSf
recv:
send: Arsf
close()
recv: SYN_RECEIVED recv: A
send: Rs
recv: rS
send: ARs
recv:
send: rsf
recv:
send: rsF
recv:
send: ArSf
recv:
send: Arsf
recv:
send: Arsf close 3 Successful abortive close of a synchronised socket
send: ARs
bad recv segment stupid ack, or LAND DoS
states on the complete connection queue close 7 Successfully close the last file descriptor for a socket in the CLOSED,
SYN SENT or SYN RECEIVED states.
close 8 Successfully close the last file descriptor for a listening TCP socket

connect 1 Begin connection establishment by creating a SYN and trying to

enqueue it on host’s outqueue
deliver_in_2 deliver_in_3 connect 4 Fail: socket has pending error
recv: ArS recv: rf
send: Ars send: di3out
deliver in 1 Passive open: receive SYN, send SYN,ACK
deliver in 1b For a listening socket, receive and drop a bad datagram and either
generate a RST segment or ignore it. Drop the incoming segment if
the socket’s queue of incomplete connections is full.
deliver in 2 Completion of active open (in SYN SENT receive SYN,ACK and
send ACK) or simultaneous open (in SYN SENT receive SYN and
send SYN,ACK)
deliver_in_2 deliver_in_2 deliver_in_2 deliver_in_3 deliver_in_3 deliver_in_8 deliver_out_1 timer_tt_rexmt_1 timer_tt_persist_1 timer_tt_keep_1 deliver_in_3 deliver in 2a Receive bad or boring datagram and RST or ignore for SYN SENT
recv: arS
send: ArSf
recv: ArS
send: Ars
recv: ArS
send: Ars
recv: rF
send: di3out
ESTABLISHED recv: rf
send: di3out
recv: rS
send: ARs
recv:
send: rsf
recv:
send: Arsf
recv:
send: Arsf
recv:
send: Arsf
recv: rf
send: di3out
socket
deliver in 3 Receive data, FINs, and ACKs in a connected state
deliver in 3b Receive data after process has gone away
deliver in 3c Receive stupid ACK or LAND DoS in SYN RECEIVED state
deliver in 6 Receive and drop (silently) a sane segment that matches a CLOSED
socket
listen_1 close_7 socket_1 deliver in 7 Receive RST and zap non-{CLOSED; LISTEN; SYN SENT;
listen() close() socket() SYN RECEIVED; TIME WAIT} socket
recv: recv: recv:
send: send: send: deliver in 7a Receive RST and zap SYN RECEIVED socket
deliver in 7b Receive RST and ignore for LISTEN socket
deliver in 7c Receive RST and ignore for SYN SENT(unacceptable ack) or
TIME WAIT socket
deliver in 7d Receive RST and zap SYN SENT(acceptable ack) socket
deliver in 8 Receive SYN in non-{CLOSED; LISTEN; SYN SENT;
TIME WAIT} state
connect_1
deliver_in_2 deliver_in_3 deliver_out_1 timer_tt_rexmt_1 timer_tt_persist_1 deliver_in_2 deliver_in_3 deliver in 9 Receive SYN in TIME WAIT state if there is no matching LISTEN
connect())
recv: ArS recv: rF recv: recv: recv: recv: ArS recv: rf
recv: socket or sequence number has not increased
send: Ars send: di3out send: rsF send: ArsF send: ArsF send: Ars send: di3out
send: arSf
deliver out 1 Common case TCP output
listen 1 Successfully put socket in LISTEN state
listen 1c Successfully put socket in the LISTEN state from any non-
{CLOSED; LISTEN} state on FreeBSD
shutdown 1 Shut down read or write half of TCP connection
socket 1 Successfully return a new file descriptor for a fresh socket
connect_1
timer_tt_conn_est_1
connect())
connect_4 deliver_in_7d timer_tt_rexmtsyn_1 deliver_in_3 timer_tt_rexmt_1 deliver_in_7a timer tt 2msl 1 2*MSL timer expires
recv: recv: recv: AR recv: recv: rF recv: recv: R
send:
recv:
send: send: send: send: di3out send: ARs send: timer tt conn est 1 connection establishment timer expires
send: arSf
except on WinXP maxrxtshift reached maxrxtshift reached timer tt fin wait 2 1 FIN WAIT 2 timer expires
timer tt keep 1 keepalive timer expires
timer tt persist 1 persist timer expires
timer tt rexmt 1 retransmit timer expires
timer tt rexmtsyn 1 SYN retransmit timer expires
deliver_in_3 deliver_in_3 deliver_in_8 deliver_out_1 timer_tt_persist_1 timer_tt_keep_1 deliver_in_3 deliver_in_8 deliver_out_1 deliver_out_1 timer_tt_rexmt_1 timer_tt_keep_1 deliver_in_3 deliver_in_3 deliver_in_8 deliver_out_1 deliver_out_1 timer_tt_rexmt_1 timer_tt_keep_1
CLOSE_WAIT recv: rf
send: di3out
recv: rF
send: di3out
recv: rS
send: ARs
recv:
send: rsf
recv:
send: Arsf
recv:
send: Arsf
FIN_WAIT_1 recv: rf
send: di3out
recv: rS
send: ARs
recv:
send: rsf
recv:
send: rsF
recv:
send: Arsf
recv:
send: Arsf
CLOSING recv: rf
send: di3out
recv: rF
send: di3out
recv: rS
send: ARs
recv:
send: rsf
recv:
send: rsF
recv:
send: Arsf
recv:
send: Arsf

The RFC793 Original

close_3
deliver_in_7 timer_tt_rexmt_1
close() Transmission Control Protocol
recv: R recv:
send: send: ARs
recv: Functional Specification
send: ARs
maxrxtshift reached
+---------+ ---------\ active OPEN
| CLOSED | \ -----------
+---------+<---------\ \ create TCB
| ^ \ \ snd SYN
passive OPEN | | CLOSE \ \
deliver_out_1 timer_tt_persist_1 deliver_in_3 deliver_in_3 deliver_in_3 deliver_in_3
recv: recv: recv: rf recv: rF recv: rF recv: rf ------------ | | ---------- \ \
send: rsF send: ArsF send: di3out send: di3out send: di3out send: di3out create TCB | | delete TCB \ \
V | \ \
+---------+ CLOSE | \
| LISTEN | ---------- | |
+---------+ delete TCB | |
rcv SYN | | SEND | |
close_3 close_3 close_3
deliver_in_7
close() close()
deliver_in_3b deliver_in_7 timer_tt_rexmt_1 deliver_in_3
close()
deliver_in_3b deliver_in_7 timer_tt_rexmt_1 ----------- | | ------- | V
recv: R recv: rs recv: R recv: recv: rF recv: rs recv: R recv:
send:
recv: recv:
send: Rs send: send: ARs send: di3out
recv:
send: Rs send: send: ARs
+---------+ snd SYN,ACK / \ snd SYN +---------+
send: ARs send: ARs send: ARs | |<----------------- ------------------>| |
process gone away maxrxtshift reached process gone away maxrxtshift reached
| SYN | rcv SYN | SYN |
| RCVD |<-----------------------------------------------| SENT |
| | snd ACK | |
| |------------------ -------------------| |
deliver_in_3 deliver_in_8 deliver_out_1 deliver_out_1 timer_tt_rexmt_1 timer_tt_keep_1 deliver_in_3 deliver_in_8 deliver_out_1 timer_tt_keep_1 deliver_in_3 deliver_in_3 deliver_in_7c deliver_in_9 deliver_out_1 +---------+ rcv ACK of SYN \ / rcv SYN,ACK +---------+
LAST_ACK recv: rf
send: di3out
recv: rS
send: ARs
recv:
send: rsf
recv:
send: rsF
recv:
send: Arsf
recv:
send: Arsf
FIN_WAIT_2 recv: rf
send: di3out
recv: rS
send: ARs
recv:
send: rsf
recv:
send: Arsf
TIME_WAIT recv: rf
send: di3out
recv: rF
send: di3out
recv: R
send:
recv: rS
send: Rs
recv:
send: rsf | -------------- | | -----------
no listening socket | x | | snd ACK
| V V
| CLOSE +---------+
| ------- | ESTAB |
close_3 close_3 connect_1 close_3
| snd FIN +---------+
deliver_in_3b deliver_in_7 timer_tt_rexmt_1 deliver_in_3 deliver_in_7 timer_tt_fin_wait_2_1 deliver_in_3b deliver_in_1 deliver_in_3b timer_tt_2msl_1
recv: rs recv: R recv:
close()
recv: rF recv: R recv:
close()
recv: rs
connect()
recv: arS recv: rs recv:
close() | CLOSE | | rcv FIN
recv: recv: recv: recv:
send: Rs send: send: ARs
send: ARs
send: di3out send: send:
send: ARs
send: Rs
send:
send: ArSf send: Rs send:
send: ARs
V ------- | | -------
process gone away maxrxtshift reached process gone away segments for new conn process gone away
if the enqueue failed +---------+ snd FIN / \ snd ACK +---------+
| FIN |<----------------- ------------------>| CLOSE |
| WAIT-1 |------------------ | WAIT |
+---------+ rcv FIN \ +---------+
connect_1 | rcv ACK of FIN ------- | CLOSE |
deliver_in_6
CLOSED connect()
recv:
recv: unconstrained
send:
| --------------
V x
snd ACK |
V
------- |
snd FIN V
send:
if the enqueue failed +---------+ +---------+ +---------+
|FINWAIT-2| | CLOSING | | LAST-ACK|
+---------+ +---------+ +---------+
| rcv ACK of FIN | rcv ACK of FIN |
| rcv FIN -------------- | Timeout=2MSL -------------- |
| ------- x V ------------ x V

http://www.cl.cam.ac.uk/users/pes20/Netsem \ snd ACK +---------+delete TCB +---------+

------------------------>|TIME WAIT|------------------>| CLOSED |
+---------+ +---------+
March 18, 2005 TCP Connection State Diagram
Figure 6. September 1981