Course contents

Unit 7: TCP, UDP and PortsLesson 7.1.4 (4 of 23 in this unit)53 of 104 in the Network Fundamentals course

TCP options

MSS, window scale, SACK and timestamps: what each option does and how the SYN negotiates them.

Intermediate · 9 min read

Covers MSS, Window scale, SACK and Timestamps.

Technical definition

TCP options are optional fields placed after the fixed 20-byte TCP header. Each is a kind number, usually a length, and a value. They let TCP gain features such as larger windows and selective acknowledgement without changing the base header.

Why TCP has options

The TCP header is 20 bytes and has no spare fields. Features invented later, such as bigger windows, had to go somewhere. The answer is the options area after the fixed header. The data offset field says how long the whole header is, in 4-byte words, so a receiver always knows where the options end and the data begins. The header, options included, can be up to 60 bytes.

Options in a typical SYN segment, drawn to scale
Options in a typical SYN segment, drawn to scaleAfter the fixed 20-byte header, a typical SYN carries five option entries totalling 20 bytes: maximum segment size 1460, selective acknowledgement permitted, timestamps, one padding byte and window scale 7. The header length becomes 40 bytes, so the data offset field is 10.Fixed20 bytesMSSMSSkind 2, len 41460SACKSACKkind 4, len 2permittedTimestampsTimestampskind 8, len 10TSval, TSecrNNOPkind 1padWin scaleWin scalekind 3, len 3shift 7Options: 4 + 2 + 10 + 1 + 3 = 20 bytesHeader = 20 + 20 = 40 bytes, so Data Offset = 10 (words of 4 bytes).The three-way handshake is the only time MSS and window scale are exchanged.
Each option is kind, length, value, except the one-byte NOP and end-of-options. Options exist only because the 20-byte header has no room for new features; a header with options is up to 60 bytes.

Options are offered by each side in its SYN and a feature is used only if both sides offered it. Most options appear only in the handshake; a few (SACK blocks, timestamps) travel in later segments too.

The options you meet every day

Common TCP options
Common TCP optionsOption; Kind; What it does; Seen in. End of option list: 0 Marks the end of the options Any segment, as padding No operation (NOP): 1 One byte of padding so the next option starts on a 4-byte boundary Any segment with options Maximum segment size (MSS): 2 The largest data size this end will accept in one segment SYN and SYN-ACK only Window scale: 3 A shift count that multiplies the 16-bit window field SYN and SYN-ACK only SACK permitted: 4 Offers selective acknowledgement SYN and SYN-ACK only SACK: 5 Lists byte ranges received out of order ACKs after loss Timestamps: 8 Two 32-bit timestamps for measuring round-trip time and rejecting old segments Most segments once agreedOptionKindWhat it doesSeen inEnd of option list0Marks the end of theoptionsAny segment, as paddingNo operation (NOP)1One byte of padding sothe next option starts ona 4-byte boundaryAny segment with optionsMaximum segmentsize (MSS)2The largest data sizethis end will accept inone segmentSYN and SYN-ACK onlyWindow scale3A shift count thatmultiplies the 16-bitwindow fieldSYN and SYN-ACK onlySACK permitted4Offers selectiveacknowledgementSYN and SYN-ACK onlySACK5Lists byte rangesreceived out of orderACKs after lossTimestamps8Two 32-bit timestamps formeasuring round-trip timeand rejecting oldsegmentsMost segments once agreed

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Kind is the number a capture tool uses to identify the option. NOP and end-of-list are a single byte with no length.

Maximum segment size (MSS)

MSS is the biggest amount of data an end will accept in one segment, not counting headers. Each side announces its own. On Ethernet with a 1500-byte MTU it is normally 1460: 1500 minus 20 bytes of IP header and 20 bytes of TCP header. The sender uses the smaller of its own limit and the one the other side announced. This avoids fragmentation: splitting an IP packet because it is too big for a link.

A tunnel, VPN or PPPoE link uses some of those 1500 bytes for its own header, so a full-size packet no longer fits. If a router in the path drops it and the ICMP message that would warn the sender is filtered, large downloads hang while small pages load. The fix is to rewrite the MSS in the SYN as it passes through:

interface GigabitEthernet0/1 ip tcp adjust-mss 1360

Cisco IOS: the router lowers the MSS in TCP SYNs that cross this interface to 1360, leaving room for tunnel headers. Pick a value for your link; 1360 is only an example.

Window scale

The window field is 16 bits, so it tops out at 65,535 bytes. On a fast link with a long round trip, that is too little to keep the pipe full. The window scale option sends a shift count, from 0 to 14. The real window is the field value multiplied by 2 to that power. A window field of 502 with a shift of 7 means 502 × 128 = 64,256 bytes. The largest possible shift gives a window of about 1 GiB. See windowing for what the window does.

SACK and timestamps

  • Selective acknowledgement lets a receiver say which byte ranges it did get after a gap. Without it a single lost segment makes the sender guess which later ones also need resending. With SACK the sender resends only the hole.
  • Timestamps carry the sender's clock value and echo the other side's. They give TCP a round-trip time sample for every acknowledgement and guard against old duplicate segments being mistaken for new ones on very fast links.
Example output · based on Cisco documentation; exact format varies by platform and software version
$tcpdump -nn -v 'tcp[tcpflags] & tcp-syn != 0'
IP 192.0.2.10.51514 > 198.51.100.20.443: Flags [S], seq 1000, win 64240,
  options [mss 1460,sackOK,TS val 100 ecr 0,nop,wscale 7], length 0
Example output: the five options from the figure in a real SYN. The window field in this segment is not scaled; scaling applies to the segments after the handshake.

When options cause problems

  • A firewall or NAT device that strips unknown options can switch off window scaling or SACK and cut throughput without any error.
  • A wrong MSS on a tunnel makes only big transfers fail. Test with ping -M do -s 1472 host on Linux to see the largest packet that passes a 1500-byte path.
  • Reading options needs a capture of the handshake; options in later segments do not repeat the scale factor.

TCP options in short

  • Options follow the 20-byte header; data offset gives the full header length.
  • MSS = MTU minus IP and TCP headers (1460 on plain Ethernet).
  • Window scale multiplies the 16-bit window by 2 to the shift; set only in the SYN.
  • SACK and timestamps improve loss recovery and round-trip measurement.

Test yourself

Predict · scenario 1

On a 1500-byte Ethernet MTU, what is the normal TCP MSS?

Predict · scenario 2

In which segments can the window scale option be sent?

Predict · scenario 3

A window field of 100 with a window scale shift of 4 means a real window of:

Predict · scenario 4

Large downloads over a VPN stall, while small pages work. What is the best first fix?

Predict · scenario 5

What does the data offset field tell the receiver?

FAQ

Why is the usual MSS 1460?
An Ethernet frame carries 1500 bytes of IP packet. Subtract a 20-byte IP header and a 20-byte TCP header and 1460 bytes are left for data. Tunnels and PPPoE use some of the 1500, so their MSS is smaller.
Can window scaling be turned on after the connection starts?
No. The scale factor is only exchanged in the SYN and SYN-ACK. If either side leaves it out, neither side can scale the window for the life of that connection.
Do I need to configure TCP options?
Rarely. Operating systems negotiate them automatically. The one place engineers touch them is MSS clamping on tunnels and WAN links, to stop large segments being dropped.