TCP half-open: Difference between revisions

Revision as of 03:39, 9 June 2006

Latest revision as of 14:46, 10 May 2025

(48 intermediate revisions by 32 users not shown)

Line 1:

{{unreferenced|date=May 2017}}

A '''Half-open Connection''' refers to a [[Transmission Control Protocol|TCP]] connection that is partially open.

The term '''half-open''' refers to [[Transmission Control Protocol|TCP]] connections whose state is out of synchronization between the two communicating hosts, possibly due to a crash of one side. A connection which is in the process of being established is also known as '''embryonic connection'''. The lack of synchronization could be due to [[SYN flood|malicious intent]].

The TCP protocol has a three state system for opening a connection. First, the originating site (A) sends a SYN packet to the destination (B). A is now half-open, and awaiting a response. B now updates its kernel information to indicate the incomming connection from A, and sends out a request to open a channel back (the SYN/ACK packet).

== RFC 793 ==

At this point, B is now "Half-open" (it has sufficient information to receive packets, but not enough to send packets back). Note that B was put into this state by another machine, outside of B's control.

According to [http://www.ietf.org/rfc/rfc0793.txt RFC 793], a TCP connection is referred to as ''half-open'' when the host at one end of that TCP connection has crashed, or has otherwise removed the socket without notifying the other end. If the remaining end is idle, the connection may remain in the half-open state for unbounded periods of time.

== Stateful Firewall Timeout ==

Under normal circumstances (see [[denial-of-service attack]] for deliberate failure cases), A will receive the SYN/ACK from B, update its tables (which now have enough information for A to both send and receive), and send a final ACK back to B.

Another circumstance that can lead to half-open connections is if a [[stateful firewall]] times out a connection that is idle for too long. In this case, the firewall clears its internal state, and if either side of the connection sends a packet, the firewall will drop the packet. This will often result in a half-open connection as the two sides of the connection can end up with inconsistent connection states.

== Embryonic connection ==

Once B receives this final ACK, it also has sufficient information for two-way communication, and the connection is fully open.

The term ''half-open connection'' can also be used to describe an '''embryonic connection''', i.e. a [[Transmission Control Protocol|TCP]] connection that is in the process of being established.

The[[Transmission Control Protocol|TCP protocol]] has a [[Three-way handshake|three state system]] for opening a connection. First, the originating siteendpoint (A) sends a [[SYN (TCP)|SYN packet]] to the destination (B). A is now half-openin an embryonic state (specifically, SYN_SENT), and awaiting a response. B now updates its kernel information to indicate the incommingincoming connection from A, and sends out a request to open a channel back (the [[SYN/ACK]] packet).

At this point, B is nowalso "Half-open"in (itan hasembryonic sufficientstate information to receive packets(specifically, but not enough to send packets backSYN_RCVD). Note that B was put into this state by another machine, outside of B's control.

Under normal circumstances (see [[denial-of-service attack]] for deliberate failure cases), A will receive the SYN/ACK from B, update its tables (which now have enough information for A to both send and receive), and send a final ACK back to B.

Once B receives this final ACK, it also has sufficient information for two-way communication, and the connection is fully open. Both endpoints are now in an established state.

== See also ==

* [[SYN flood]]

* [[SYN cookies]]

* [[Stateful firewall]]

== References ==

{{refbegin}}

*Twingate. (n.d.). ''What is a TCP Half Open Scan?''. Retrieved May 2, 2025, from [https://www.twingate.com/blog/glossary/tcp-half-open-scan](https://www.twingate.com/blog/glossary/tcp-half-open-scan)

*Palo Alto Networks. (n.d.). ''TCP Half Closed and TCP Time Wait Timers''. Retrieved May 2, 2025, from [https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/session-settings-and-timeouts/tcp/tcp-half-closed-and-tcp-time-wait-timers](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/session-settings-and-timeouts/tcp/tcp-half-closed-and-tcp-time-wait-timers)

*Sanchit Gurukul. (n.d.). ''Understanding TCP Half-Open Connections''. Retrieved May 2, 2025, from [https://sanchitgurukul.com/understanding-tcp-half-open-connections](https://sanchitgurukul.com/understanding-tcp-half-open-connections)

[[Category:Transmission Control Protocol|Half-Open]]

{{refend}}

== External links ==

{{compu-network-stub}}

* [http://www.ietf.org/rfc/rfc0793.txt Transmission Control Protocol DARPA Internet Program Protocol Specification]

[[Category:Computer Networks]]