A, TCP packet format
details TCP / IP protocol reference "TCP / IP protocol detailed" Three volumes. The following is a TCP packet format of FIG: 
figure above highlights the need for several fields:
(1) Reference: Seq number, representing 32 bits, used to identify the byte stream from the TCP transmission source to the destination, the initiator this marking data is transmitted.
(2) the acknowledgment number: Ack number, accounting for 32, when only the ACK flag bit is 1, the acknowledgment number field is valid, Ack = Seq + 1.
(3) Flags: a total of six, i.e. URG, ACK, PSH, RST, SYN, FIN , and specific meanings are as follows:
（A）URG：紧急指针（urgent pointer）有效。
（B）ACK：确认序号有效。
（C）PSH：接收方应该尽快将这个报文交给应用层。
（D）RST：重置连接。
（E）SYN：发起一个新连接。
（F）FIN：释放一个连接。 have to be aware of is:
(A) Do not Ack acknowledgment sequence number and ACK flag is confused.
(B) initiator validator Ack = Req + 1, both ends of the pair.
two.
Three-way handshake
The so-called three-way handshake (Three-Way Handshake) namely the establishment of a TCP connection, refers to the establishment of a TCP connection, the client and the server needs to send a total of three packages to confirm the establishment of the connection. In socket programming, this process is triggered by the execution client connect, the entire process as shown below:
(1) The first handshake: Client SYN flag bit is set to 1, a randomly generated value seq = J, and the packet is sent to the Server, Client enters the SYN_SENT state, waiting for acknowledgment Server.
(2) The second handshake: Server receives the packet data from the flag bit SYN = 1 know Client requests to establish a connection, Server SYN and ACK flag bit are set to 1, ack = J + 1, a randomly generated value seq = K, and transmits the data packet to acknowledge a connection request to the Client, Server enters SYN_RCVD state.
(3) third handshake: the Client receives acknowledgment, checking whether the ack J + 1, ACK is 1, then if the correct ACK flag is set to 1, ack = K + 1, and the data packet to Server, Server checks whether the ack K + 1, ACK is 1, if correct, the connection is established, Client and Server enters eSTABLISHED state, complete the three-way handshake, then you can begin to transfer data between Client and Server.
three.
Four waving
Three-way handshake familiar with the four waving estimated no problem, the so-called fourth wave (Four-Way Wavehand) TCP connection is terminated, refers to disconnect a TCP connection, the client and the server needs to send a total of four packets confirming the connection is disconnected. In socket programming, the process by the client or the server performs close to trigger either the entire process as shown below: 
Since the TCP connection is full-duplex, thus, each direction must be shut down separately, when a principle is one of complete data transmission job, send a FIN to terminate the connection in this direction, we received a FIN simply means that there is no data on the direction of the flow, and that is no longer receive data, but in this TCP the connection is still able to send data until this direction also send a FIN. To shut down one of the first active close, while the other performs a passive closed, the description is the case of FIG.
(1) First Wave: Client sends a FIN, for closing the data transfer Client Server tenderer, Client enters FIN_WAIT_1 state.
(2) Second wave: Server receives the FIN, ACK to send a Client, the acknowledgment number for the receipt number +1 (the same SYN, FIN a occupy a sequence number), Server enters CLOSE_WAIT state.
(3) Third Wave: Server sends a FIN, for closing the Client Server data transfer, LAST_ACK Server enters state.
(4) Fourth wave: the Client receives the FIN, Client enters TIME_WAIT state, and then sends an ACK to the Server, for the receipt of the acknowledgment number number + 1, Server enters the CLOSED state, four complete wave.
Reproduced in: https: //blog.51cto.com/14322607/2407365