TCP (`tcp`)

Layer: L4 (transport)
Header: variable length
Notes: User-defined protocols (protocols.d)

Reached from

Lower layer	Selector	Value
`ipv4`	`protocol`	6 (0x06)
`ipv6`	`next_header`	6 (0x06)
`ipv6_hopopts`	`next_header`	6 (0x06)
`ipv6_route`	`next_header`	6 (0x06)
`ipv6_srh`	`next_header`	6 (0x06)
`ipv6_frag`	`next_header`	6 (0x06)
`ipv6_dstopts`	`next_header`	6 (0x06)

Fields

Field	Type	Default	Auto	Description
`src_port`	`uint(16)`	`49152`		Source port.
`dst_port`	`uint(16)`	`80`		Destination port; selects the next layer (179 = BGP, 646 = LDP, 3868 = Diameter, 5060 = SIP).
`seq`	`uint(32)`	`0`		Sequence number of the first data octet (the initial sequence number with SYN).
`ack`	`uint(32)`	`0`		Acknowledgement number, valid when the ACK flag is set.
`data_offset`	`uint(4)`		Length of the header in 32-bit words	Header length in 32-bit words, 5 to 15 (Auto, includes the options).
`reserved`	`uint(4)`	`0`		Reserved bits, 0.
`flags`	`flags(8)`	`0x2`		Control flags: CWR, ECE, URG, ACK, PSH, RST, SYN, FIN (default SYN).
`window`	`uint(16)`	`65535`		Receive window in octets (scaled by the window scale option).
`checksum`	`uint(16)`		Internet checksum with pseudo header over the header and everything after it	Internet checksum with the IPv4 / IPv6 pseudo header (Auto).
`urgent_ptr`	`uint(16)`	`0`		Urgent pointer, valid when the URG flag is set.
`options`	`tlv` — `data_offset * 4 - 20` octets			TCP options as TLVs: EOL, NOP, MSS, window scale, SACK permitted, SACK, timestamps.
`padding`	`padding(4)`			Zero padding of the options to a 32-bit boundary (Auto).

`flags`

Bit	Mask	Name
7	128 (0x80)	`cwr`
6	64 (0x40)	`ece`
5	32 (0x20)	`urg`
4	16 (0x10)	`ack`
3	8 (0x08)	`psh`
2	4 (0x04)	`rst`
1	2 (0x02)	`syn`
0	1 (0x01)	`fin`

`options`

Type 8 bits, length 8 bits.
The length counts the type and length fields too.
Unknown types are kept as raw value octets.

Type	Name	Value fields
0 (0x00)	`eol`	(type only, no length or value)
1 (0x01)	`nop`	(type only, no length or value)
2 (0x02)	`mss`	`value`
3 (0x03)	`ws`	`shift`
4 (0x04)	`sack_permitted`
5 (0x05)	`sack`	`blocks`
8 (0x08)	`timestamps`	`tsval`, `tsecr`

`options` › `mss`

Field	Type	Default	Auto	Description
`value`	`uint(16)`

`options` › `ws`

Field	Type	Default	Auto	Description
`shift`	`uint(8)`

`options` › `sack`

Field	Type	Default	Auto	Description
`blocks`	`list<struct>` — rest of the PDU

`options` › `sack` › `blocks`

Each item is a group of the fields below.

Field	Type	Default	Auto	Description
`left`	`uint(32)`
`right`	`uint(32)`

`options` › `timestamps`

Field	Type	Default	Auto	Description
`tsval`	`uint(32)`
`tsecr`	`uint(32)`

The next layer is selected by dst_port; when the field is Auto the builder writes the value of the protocol stacked above. When decoding, src_port is looked up too if the first field matches no entry.

Value	Protocol	Note
179 (0x00b3)	`bgp`
646 (0x0286)	`ldp`
3868 (0x0f1c)	`diameter`
5060 (0x13c4)	`sip`

Constraints

Level	Rule
error	`data_offset` within 5..15

Sample templates

bad-tcp-checksum — templates/malformed/tcp-bad-checksum.wpg.yaml
tcp-data-psh-ack — templates/protocols/l4/tcp-data.wpg.yaml
tcp-syn-options — templates/protocols/l4/tcp-syn.wpg.yaml
diameter-ccr-initial — templates/protocols/mobile/diameter-ccr-initial.wpg.yaml
diameter-cer — templates/protocols/mobile/diameter-cer.wpg.yaml
ldp-initialization — templates/protocols/mpls/ldp-initialization.wpg.yaml
ldp-label-mapping — templates/protocols/mpls/ldp-label-mapping.wpg.yaml
ldp-label-withdraw — templates/protocols/mpls/ldp-label-withdraw.wpg.yaml
bgp-open — templates/protocols/routing/bgp-open.wpg.yaml
sip-register — templates/protocols/voip/sip-register.wpg.yaml
scenario-tcp-syn-port-scan — templates/scenarios/tcp-syn-port-scan.wpg.yaml
scenario-vlan-syn-flood — templates/scenarios/vlan-syn-flood.wpg.yaml

wpg Documentation