3

I want to ask how TCP creates streams (and what exactly is a stream). In Wireshark for example, I see multiple streams to one server and I can not understand how/when TCP creates this streams from the same connection. I also read that HTTP/1.1 uses multiple connections to get more objects from the web server at the same time, so are these connections same with streams in Wireshark?

Thank you in advance.

|improve this question
4

In brief, a given TCP connection is specified by four things:

  • Host A IP address
  • Host A port number
  • Host B IP address
  • Host B port number

This is what uniquely defines a given connection.

When a host opens a TCP connection to another (perhaps a web fetch), it chooses an unused port, typically a "random high port number", and makes the connection to the well-known port number of the server, perhaps 80. If it opens another connection to the same server, it will have a different local port.

Captured in real life during a web refresh of a page, my computer had many connections of which these are two:

192.168.0.28:34628      69.30.95.247:80
192.168.0.28:34626      69.30.95.247:80

As a given host has a maximum of 2^16 ports (in IPv4), it can have at most 65,536 simultaneous connections to a given web server on the normal web port (minus some ports which have special meanings). That's not a problem for an individual's computer, but might be for a large web proxy. (And a given operating system might well have other much smaller limits: the limit I'm speaking of is inherent in the protocol limit.)

Hope that helps clarify somewhat.

|improve this answer
  • Since TCP really knows nothing about clients and servers, which are an application-layer concept, it would be more appropriate to refer to source and destination IP and TCP addresses. – Ron Maupin♦ Dec 20 '17 at 2:24
  • You're quite right as always; I've edited to speak of hosts A and B; I'd say src and dst only really apply to a given packet. – jonathanjo Dec 20 '17 at 2:44
  • Why can't a host have more than 65536 different connections if the TCP identifier is a combination of 4 things, the client can just re-use the same port numbers, like servers do – Ferrybig Jan 2 '18 at 8:50
  • @ferrybig: I edited my answer to clarify that the limit is for simultaneous connections. For a given addr1, addr2, and port2, as only port1 can vary. After the connection is fully closed the number can be reused, exactly as you say. – jonathanjo Jan 2 '18 at 12:48
  • Isn't it theoretically possible to for two TCP connections (occuring one after the other to re-use the same source port), thereby having two connections but the same src,dst,sport,dport combination? In that case, wouldn't using this combination as the stream identifier be incorrect? – Lelouch Lamperouge Feb 13 '19 at 20:28
2

TCP streams are really large blocks of data sent by an application to TCP. TCP will segment the data into PDUs (protocol Data Units) called segments that fit the MSS (Maximum Segment Size). The TCP on the other end will reassemble the segments and recreate the data stream and pass it to the receiving application. To the applications, it is merely a stream of data, and TCP handles all the details. A TCP stream happens over a TCP connection. An application can open as many TCP connections as allowed by a host OS (off-topic here), and use those connections for data streams.

HTTP, on the other hand, is an application-layer protocol, which are off-topic here.

|improve this answer
  • But, what really is a stream, how TCP decides when to make new stream and when to open new connections, or which factor decides this? You say that HTTP is off topic, but then how HTTP/1.1 make more than one (TCP) connections to the same server, for the same web page? I can't get this. – Isaac Newton Dec 20 '17 at 12:28
  • My answer above shows exactly this situation: two TCP connections between the same two hosts. The port number is different on the side that opened the connection. A web browser might open one TCP connection to get the HTML, then one per asset (image, whatever), serially or in parallel as it pleases. A mail sender might open one per message, serially or in parallel, or one per other server as needed, as it pleases. – jonathanjo Dec 20 '17 at 13:40
  • @IsaacNewton, TCP doesn't decide to open new connections. As I wrote, the application does. What applications, or application-layer protocols do is off-topic here.HTTP is an application-layer protocol, so it is off-topic. That would be what decides to open more connections for more data streams. See What topics can I ask about here?, where under the Off-Topic section, it says, "protocols above L4 in the OSI model (e.g. HTTP, FTP, etc)" – Ron Maupin♦ Dec 20 '17 at 16:13
  • OK, I get it that Application Layer Protocol are responsible for opening new connection/s, but what I still can't get is the difference between TCP stream and TCP connection. Are this a same thing, are all streams use same connection? – Isaac Newton Dec 21 '17 at 23:20
  • The application will instruct TCP to open a connection to another host. Then the application sends a bunch of data across the TCP connection. TCP segments the data sends it to TCP on the other host, where it is reassembled and given to the application in the correct order, which is referred to as a data stream. – Ron Maupin♦ Dec 21 '17 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.