Inside a Segment — Header, Checksum and MSS
TCP hands your program one smooth stream of bytes, but on the wire that stream travels in pieces called segments. When the lobby sends a player the 4,000-byte list of open matches, the list crosses the network as several segments, and each one carries a header that lets the far end rebuild the stream, spot damage and find where the data starts.
The rule
A segment is a header plus a slice of the stream; MSS caps the slice.
The header is at least 20 bytes:
0 16 32 bits
+------------------+------------------+
| source port | destination port |
+------------------+------------------+
| sequence number |
+-------------------------------------+
| acknowledgment number |
+--------+---------+------------------+
| offset | flags | window |
+--------+---------+------------------+
| checksum | urgent pointer |
+------------------+------------------+
| options (0 to 40 bytes) |
+-------------------------------------+
| data (at most MSS bytes) |- Ports — which program at each end.
- Sequence number — where this segment's first data byte sits in the stream.
- Acknowledgment number — the next byte this side expects to receive.
- Data offset — the header's length, counted in 4-byte words, so the receiver knows where the data begins. Options make headers longer than 20 bytes.
- Flags — SYN, ACK and FIN you have met; RST aborts a connection; PSH and URG are rarer.
- Window — how much more data this side can accept right now. It gets its own lesson.
- Checksum — a 16-bit sum over the header, the data and the two IP addresses. The receiver recomputes it, and if it does not match, the segment is silently thrown away. No acknowledgment comes back for it, so the sender eventually sends it again. It catches accidental damage, not attackers: anyone can compute a correct checksum.
- Urgent pointer — used with URG to mark "out-of-band" urgent bytes in the stream. It is a relic that modern programs, games included, leave alone.
The maximum segment size (MSS) is the most data one segment may carry. Each side announces its MSS as an option in its SYN. It is sized so that a full segment fits in one packet on the link. Ordinary Ethernet carries packets of up to 1500 bytes, a limit called its MTU (maximum transmission unit), and 1500 bytes minus a 20-byte IPv4 header minus a 20-byte TCP header leaves 1460.
The shortcut
To see how a message splits, work out segments = bytes ÷ MSS, rounded up. Each segment's sequence number is the previous one plus the bytes it carried.
Find the MSS
Both sides announced 1460 in their SYNs, so each segment carries at most 1460 data bytes.
Drills
Answer fast — trust the rule.
What is the smallest possible TCP header?
On a link with a 1500-byte MTU, using IPv4 and TCP headers with no options, what is the MSS?
With an MSS of 1460, how many segments does a 3,000-byte message need?
A segment arrives with a checksum that does not match its contents. What happens?
Which header field tells the receiver where the header ends and the data begins?
Remember
- A segment is a header (20 to 60 bytes) plus a slice of the stream; MSS caps the slice.
- Segments = bytes ÷ MSS, rounded up, and each sequence number follows on from the last.
- Trap: treating the checksum as security. It catches accidents, not attackers.