1. The Story
Press "Next" to go through it step by step. At each step a character appears and explains what they are doing.
Prologue: A quick recap
Step 1 of 13
Handshake first
Before sending data with TCP (Transmission Control Protocol), the two sides first do a Three-way Handshake: SYN "Hello?", SYN-ACK "Hello!", ACK "Let's begin!"
Animation text version (all steps)
- Prologue: A quick recap
- Handshake first · Pip: Before sending data with TCP (Transmission Control Protocol), the two sides first do a Three-way Handshake: SYN "Hello?", SYN-ACK "Hello!", ACK "Let's begin!"
- During the handshake, each side also shares its starting Sequence Number
- More details: Lesson 9
- IP only does its best · Mac: I want to download a photo. But Routers on the Internet only make a "best effort": when they are too busy they may drop packets, and they do not guarantee the order either. If the photo is missing a piece, it turns into a broken picture. What can we do?
- IP: finds the way, but does not guarantee delivery or order
- TCP: adds "definitely delivered, in order" at the two ends
- Act 1: Every piece has a number
- Cut up and numbered · Pip: The server cuts the 6,000-Byte photo into 6 pieces of 1,000 Bytes each. Every backpack has a Sequence Number written on it: the Byte that piece starts at.
- Piece 1: Seq 1 (Bytes 1 to 1,000)
- Piece 2: Seq 1001
- Piece 3: Seq 2001
- Piece 4: Seq 3001
- Pieces 5 and 6: Seq 4001, 5001
- The real starting number is random; here we use "relative sequence numbers" starting from 1
- Sending piece 1 · Pip: I set off carrying Seq 1 and arrive safely at Mac's!
- ACK: the next number wanted · Mac: I have received Bytes 1 to 1,000, so I reply ACK 1001. It means: "Everything before 1001 has arrived. Please start the next piece at 1001."
- ACK (acknowledgement) = the next Byte number wanted
- It is cumulative: ACK 1001 means everything before 1001 has arrived
- Sending several at once · Pip: Waiting for an ACK after every piece is too slow! The server can send several pieces at once, then wait for the ACKs together. Seq 1001 to 5001 all set off together!
- The amount of data that can be "on the road" at once without being acknowledged is called the Window
- Act 2: One Pip goes missing
- Seq 2001 has vanished! · Pip: Oh no! A Router on the Internet was too busy and dropped the Pip carrying Seq 2001. The other Pips arrive safely.
- Mac keeps asking: ACK 2001 · Mac: I receive 1001 and reply ACK 2001. Then 3001, 4001 and 5001 arrive, but 2001 still has not! I put them to one side for now, and each time a piece arrives I reply ACK 2001 again: "I'm still waiting for 2001!"
- The first ACK 2001: the normal reply after receiving 1001
- The next three: Duplicate ACKs sent on receiving 3001, 4001 and 5001
- Resending the lost piece · Pip: When the server receives 3 duplicate ACK 2001s in a row, it knows 2001 is lost and immediately sends it again. This is called Retransmission. If not even the ACKs arrive, the server will resend once its timer runs out.
- Resending straight after 3 duplicate ACKs: Fast Retransmit
- Resending only when the timer runs out: timeout retransmission
- All received: ACK 6001 · Mac: 2001 is back! Together with the pieces I had put to one side, all 6,000 Bytes have arrived. I reply ACK 6001 in one go, then put the six pieces in order by Sequence Number. The photo is complete!
- Act 3: Controlling speed and saying goodbye
- Don't send too fast · Mac: Every ACK I send also says "this is how much space I have left", called the Window. If there is not enough space, the server has to slow down. This is Flow Control. When the server notices Pips going missing, it also assumes the network is jammed and slows down. This is Congestion Control.
- Saying goodbye: FIN · Pip: When the transfer is finished, each side sends a FIN, "Goodbye!", and the other side confirms it with an ACK. This TCP conversation is now officially over.
- Summary: Safely delivered · Pip: Sequence Numbers mark where each piece belongs, and ACKs tell the sender how far things have arrived. Anything lost is resent, and anything out of order is put back in order. With TCP, web pages, emails and files all arrive complete!
- Sequence Number: the Byte this piece starts at
- ACK: the next number wanted (cumulative acknowledgement)
- Lost → duplicate ACKs or timeout → Retransmission
2. Where Is the Problem
Routers on the Internet only find the way. They follow IP (Internet Protocol), the rules for sending Packets hop by hop according to their IP Address. The IP Header also carries a TTL (Time to Live), which drops by 1 at every Router so that a packet cannot loop around forever. All IP promises is "best effort":
- Packets can be lost: when a Router is too busy and its queue is too long, it simply drops packets without telling anyone.
- Packets can arrive out of order: different packets may take different paths, so one that left later can arrive first.
- Packets can be duplicated: sometimes the same data is delivered twice.
A 6,000-Byte photo is cut into 6 Pips for the journey. A Byte is one small unit of data. If even one piece is missing, or the pieces are in the wrong order, Mac sees a broken picture.
3. How the Network Solves It
Imagine you are posting a six-volume comic set to a friend, and you write "starts at page X" on every parcel. When your friend receives one, they send back a slip saying "please start the next one at page Y". If a volume never gets a slip back, you post it again.
That is exactly what TCP (Transmission Control Protocol) does. The computers at both ends give the data Sequence Numbers, and the receiver replies with an ACK (acknowledgement) saying "the next number I want". Anything lost is sent again, and anything out of order is put back in order.
The Routers along the way do not have to deal with any of this. Everything is handled by the two ends.
4. A Closer Look
Sequence Numbers count Bytes, not pieces
A Sequence Number means "the first Byte of this piece is Byte number X of the whole data". In the story, the server example.com (192.0.2.80:443) cuts the photo into pieces of 1,000 Bytes each. (Note: an address starting with 192 is not necessarily Private. Only addresses starting with 192.168 are.)
| Piece | Sequence Number | Bytes included |
|---|---|---|
| Piece 1 | 1 | 1 – 1,000 |
| Piece 2 | 1001 | 1,001 – 2,000 |
| Piece 3 | 2001 | 2,001 – 3,000 |
| Piece 4 | 3001 | 3,001 – 4,000 |
| Piece 5 | 4001 | 4,001 – 5,000 |
| Piece 6 | 5001 | 5,001 – 6,000 |
The real starting Sequence Number is chosen at random during the Three-way Handshake, for example 2837461005. Tools such as Wireshark convert it to a "relative sequence number" starting from 1 to make it easier to read, and the story does the same.
ACK = the next Byte number wanted
When Mac has received Bytes 1 to 1,000, he replies ACK 1001. It means "I have received everything before 1001. Please carry on from 1001."
ACKs are cumulative: ACK 6001 means Bytes 1 to 6,000 have all arrived, so there is no need to reply to each piece one by one.
Window: how many pieces to send at once
If the server had to stop and wait for an ACK after every piece, all the round-trip time would be wasted. So the server can send several pieces at once, then wait for the ACKs together.
The amount of data that can be "on the road" at the same time without being acknowledged yet is called the Window.
How is a lost piece noticed?
In the story, Seq 2001 is dropped on the Internet. Here is what Mac receives:
Received Mac replies
Seq 1001 → ACK 2001
(2001 lost)
Seq 3001 → ACK 2001 (duplicate)
Seq 4001 → ACK 2001 (duplicate)
Seq 5001 → ACK 2001 (duplicate)
Seq 2001 → ACK 6001 (resent)
Mac keeps 3001, 4001 and 5001 in a Buffer for now, a temporary holding area, instead of throwing them away. The server can notice the loss in two ways:
- Fast Retransmit: after receiving 3 Duplicate ACKs in a row, it resends 2001 immediately, without waiting.
- Timeout retransmission: after sending data, the server starts a timer. If no ACK has arrived when the timer runs out, it sends the data again. This is the method that saves the day if even the ACK gets lost on the way.
Both are kinds of Retransmission. Once 2001 has been filled in, Mac replies ACK 6001 in one go, then puts the six pieces in order by their Sequence Numbers.
Flow Control and Congestion Control
- Flow Control: every ACK from Mac also says "this is how much space I have left", for example
ACK 6001 | Window 8000. If there is not enough space, the server has to slow down so it does not overwhelm Mac. - Congestion Control: when the server notices data going missing, it guesses the network is jammed, so it automatically sends less at a time, then gradually speeds up again.
So how much can be sent at once is decided by whichever of the two is smaller.
Saying goodbye: FIN
When the transfer is finished, each side sends a FIN, "Goodbye!", and the other side confirms it with an ACK. Because each direction has to be closed separately, there are usually four messages in total: FIN, ACK, FIN, ACK.
5. Try It Yourself
Task: See how common retransmission is
- On a computer, open "Command Prompt" (Windows) or "Terminal" (macOS/Linux).
- On Windows, type
netstat -s; on macOS, typenetstat -s -p tcp. - Among the pile of statistics, look for a line containing the word
retransmit(or "retransmitted"). - Compare it with the number of segments sent. You will find that retransmissions are rare, but they happen all the time. Every day, TCP quietly brings back lost Pips for you!
Mini game
Whose job is it?
Are the following six jobs done by TCP (the computers at both ends) or IP (the Routers along the way)?
-
1Cutting data into pieces and numbering them
-
2Delivering Packets hop by hop to their destination by IP Address
-
3Noticing that data is lost and sending it again
-
4Using TTL to stop Packets looping around forever
-
5Putting the data back in order at the receiver's end
-
6Using the Window to control the sending speed
All sorted correctly! IP does its best to find the way. TCP, at the two ends, handles numbering, acknowledging, resending and reordering, which makes delivery reliable.
6. Where the Analogy Breaks
- Pieces are not always 1,000 Bytes. The real size depends on the MTU (Maximum Transmission Unit). On Ethernet, each piece carries at most about 1,460 Bytes of data. The story uses 1,000 only to make the maths easy.
- There is not always one ACK per piece. Many computers wait until two pieces arrive before sending one ACK, or tuck the ACK inside data they are sending anyway, which saves even more.
- Sequence Numbers do not start at 1. The real starting number is a large random number. This stops data from old connections getting mixed in, and makes it harder for others to fake packets.
- TCP guarantees "delivered", not "private". TCP does not encrypt the content. To stop others peeking, you need TLS (Transport Layer Security), covered two stories from now.
- Retransmission is not endless. If it still fails after many tries, TCP gives up and drops the connection. That is when you see errors like "connection timed out".
7. Quiz
8. Key Notes
- IP only does its best, so packets can be lost, arrive out of order or be duplicated. TCP (Transmission Control Protocol) adds "definitely delivered, in order" at the two ends.
- Sequence Numbers count Bytes: they show which Byte a piece of data starts at.
- ACK (acknowledgement) = the next Byte number wanted, and it is cumulative.
- Lost data is filled in by Retransmission: Fast Retransmit after 3 Duplicate ACKs, or resending when the timer runs out.
- The Window lets the server send several pieces at once. Flow Control protects the receiver; Congestion Control protects the network.
Further reading
With Sequence Numbers and ACKs, even a lost Pip gets replaced, and the photo arrives complete. But what if nothing was lost, and instead the whole road is blocked? In the next story, Rue becomes the network doctor and uses Ping and Traceroute to find which stop the problem is at.