Transmission Control Protocol (TCP)

TCP is a reliable way of communication between two systems because it guarantees that data will arrive perfectly intact and in order and for that it first confirms that whether both systems are ready for the transmission. The notion is very simple to send packets synchronize their connection using The 3-Way Handshake and when finished sending data then terminate the connection using The 4-Way Teardown. It is used in loading a webpage, connecting to a server remotely (SSH), and Querying a relational database.

• The 3-Way Handshake

  1. SYN (Synchronize): The Client initiates the connection by sending a packet with the SYN flag set. This says that the Client wants to open a connection with the server, and its Initial Sequence Number (ISN) is XXXX.

  2. SYN-ACK (Synchronize-Acknowledge): The server receives the request and allocates memory for the connection after which it replies with both SYN and ACK flags. This says that the server acknowledge client's Initial Sequence Number (ISN) XXXX and it also picks a random Initial Sequence Number (ISN) for itself YYYY.

  3. ACK (Acknowledge): The Client receives the server's response and sends back a final ACK packet. This says that the client acknowledge server's ISN YYYY.

Here the handshake is complete and the connection is established and now the data can flow in BOTH DIRECTIONS SIMULTANEOUSLY.

• The 4-Way Teardown

  1. FIN (Finish): When the Client is done sending data, it send a FIN packet to the Server.

  2. ACK (Acknowledge): The server replies with an ACK flag and at this stage the connection is half-closed which means client cannot send more data, but if the server still has data to finish transmitting then it can continue sending it to the client.

  3. FIN (Finish): Once the server is also finished transmitting its remaining data, it sends its own FIN packet to the client.

  4. ACK (Acknowledge): Then the Client replies with a final ACK packet.

Once that final Acknowledgment is received, the connection is fully terminated and both systems release their ports and memory.

User Datagram Protocol (UDP)

UDP is faster then TCP it is a fire and forget protocol, this is because it sends data at the destination port without establishing a connection, without checking if the data is arrived, and without resending lost packets. UDP chops data into independent chunks called datagram. It is used where the speed is more important than accuracy. It is used in live video streaming or voice calls (VoIP), online-multiplayer gaming, and Domain Name System (DNS).

Internet Control Message Protocol (ICMP)

ICMP is designated for diagnostics and network management Unlike TCP and UDP, ICMP does not transport application data (like web pages, files, or video). Instead, it is used by routers, gateways, and operating system to test connectivity, report routing failures, and announce when a destination is unreachable. When we hit enter on the ping command here is how it works:

1. ICMP Type 8 (Echo Request): The Instance A generates the Type 8 Question. The firewall at Instance A's VNIC looks at the Stateful Egress rule, it sees ICMP is allowed, and lets the packet out.

2. The Memory is Created: Because the rule is Stateful, the firewall note down on its memory that Instance A just asked Instance B a question and Instance A is expecting an answer.

3. ICMP Type 0 (Echo Reply) is Generated: When the packet reaches Instance B then its OS automatically generates the Type 0 Answer which means there is no need to running ping on Instance B.

4. The Automatic Return: The Type 0 Answer travels back and arives at the VNIC of Instance A.

5. The Magic Happens here: You did not write an ingress rule allowing Type 0 Answers to enter Instance A. Because Stateful firewall looks at its memory and it sees that Instance A initiated this specific conversation milliseconds ago and it opens the VNIC dynamically and lets the answer in.