A Rigorous Approach to Networking: TCP, from Implementation to Protocol to Service

  • Tom Ridge
  • Michael Norrish
  • Peter Sewell
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5014)


Despite more then 30 years of research on protocol specification, the major protocols deployed in the Internet, such as TCP, are described only in informal prose RFCs and executable code. In part this is because the scale and complexity of these protocols makes them challenging targets for formalization.

In this paper we show how these difficulties can be addressed. We develop a high-level specification for TCP and the Sockets API, expressed in the HOL proof assistant, describing the byte-stream service that TCP provides to users. This complements our previous low-level specification of the protocol internals, and makes it possible for the first time to state what it means for TCP to be correct: that the protocol implements the service. We define a precise abstraction function between the models and validate it by testing, using verified testing infrastructure within HOL. This is a pragmatic alternative to full proof, providing reasonable confidence at a relatively low entry cost.

Together with our previous validation of the low-level model, this shows how one can rigorously tie together concrete implementations, low-level protocol models, and specifications of the services they claim to provide, dealing with the complexity of real-world protocols throughout.


Rigorous Approach Host State Conformance Testing Output Queue Abstraction Function 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Alur, R., Wang, B.-Y.: Verifying Network Protocol Implementations by Symbolic Refinement Checking. In: Berry, G., Comon, H., Finkel, A. (eds.) CAV 2001. LNCS, vol. 2102, pp. 169–181. Springer, Heidelberg (2001)Google Scholar
  2. 2.
    Biagioni, E.: A structured TCP in Standard ML. In: Proc. SIGCOMM (1994)Google Scholar
  3. 3.
    Billington, J., Han, B.: On defining the service provided by TCP. In: Proc. ACSC: 26th Australasian Computer Science Conference, Adelaide (2003)Google Scholar
  4. 4.
    Biltcliffe, A., Dales, M., Jansen, S., Ridge, T., Sewell, P.: Rigorous protocol design in practice: An optical packet-switch MAC in HOL. In: Proc. ICNP (November 2006)Google Scholar
  5. 5.
    Bishop, S., Fairbairn, M., Norrish, M., Sewell, P., Smith, M., Wansbrough, K.: Rigorous specification and conformance testing techniques for network protocols, as applied to TCP, UDP, and Sockets. In: Proc. SIGCOMM 2005 (August 2005)Google Scholar
  6. 6.
    Bishop, S., Fairbairn, M., Norrish, M., Sewell, P., Smith, M., Wansbrough, K.: Engineering with logic: HOL specification and symbolic-evaluation testing for TCP implementations. In: Proc. POPL (2006)Google Scholar
  7. 7.
    Castelluccia, C., Dabbous, W., O’Malley, S.: Generating efficient protocol code from an abstract specification. IEEE/ACM Trans. Netw. 5(4), 514–524 (1997)CrossRefGoogle Scholar
  8. 8.
    Chkliaev, D., Hooman, J., de Vink, E.: Verification and Improvement of the Sliding Window Protocol. In: Garavel, H., Hatcliff, J. (eds.) ETAPS 2003 and TACAS 2003. LNCS, vol. 2619, pp. 113–127. Springer, Heidelberg (2003)Google Scholar
  9. 9.
    Fersman, E., Jonsson, B.: Abstraction of communication channels in Promela: A case study. In: Havelund, K., Penix, J., Visser, W. (eds.) SPIN 2000. LNCS, vol. 1885, pp. 187–204. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  10. 10.
    Hofmann, R., Lemmen, F.: Specification-driven monitoring of TCP/IP. In: Proc. 8th Euromicro Workshop on Parallel and Distributed Processing (January 2000)Google Scholar
  11. 11.
    The HOL 4 system, Kananaskis-3 release,
  12. 12.
    Kohler, E., Kaashoek, M.F., Montgomery, D.R.: A readable TCP in the Prolac protocol language. In: Proc. SIGGCOMM 1999, August 1999, pp. 3–13 (1999)Google Scholar
  13. 13.
    Li, P., Zdancewic, S.: Combining events and threads for scalable network services. In: Proc. PLDI, pp. 189–199 (2007)Google Scholar
  14. 14.
    Lynch, N., Vaangdrager, F.: Forward and backward simulations – Part I: Untimed systems. Information and Computation 121(2), 214–233 (1995)zbMATHCrossRefMathSciNetGoogle Scholar
  15. 15.
    Murphy, S.L., Shankar, A.U.: A verified connection management protocol for the transport layer. In: Proc. SIGCOMM, pp. 110–125 (1987)Google Scholar
  16. 16.
    Murphy, S.L., Shankar, A.U.: Service specification and protocol construction for the transport layer. In: Proc. SIGCOMM, pp. 88–97 (1988)Google Scholar
  17. 17.
    Norrish, M., Sewell, P., Wansbrough, K.: Rigour is good for you, and feasible: reflections on formal treatments of C and UDP sockets. In: Proceedings of the 10th ACM SIGOPS European Workshop, September 2002, pp. 49–53 (2002)Google Scholar
  18. 18.
    Postel, J.: A Graph Model Analysis of Computer Communications Protocols. University of California, Computer Science Department, PhD Thesis (1974)Google Scholar
  19. 19.
    Schieferdecker, I.: Abruptly-terminated connections in TCP. In: Proc. Int. Workshop on Applied Formal Methods In System Design (1996)Google Scholar
  20. 20.
    Serjantov, A., Sewell, P., Wansbrough, K.: The UDP calculus: Rigorous semantics for real networking. In: Proc. TACS 2001 (October 2001)Google Scholar
  21. 21.
    Smith, M.A., Ramakrishnan, K.K.: Formal specification and verification of safety and performance of TCP selective acknowledgment. IEEE/ACM Trans. Netw. 10(2), 193–207 (2002)CrossRefGoogle Scholar
  22. 22.
    Smith, M.A.S.: Formal verification of communication protocols. In: Proc. FORTE IX/PSTV XVI (1996)Google Scholar
  23. 23.
    The Netsem Project. Web page,
  24. 24.
    Wansbrough, K., Norrish, M., Sewell, P., Serjantov, A.: Timing UDP: Mechanized Semantics for Sockets, Threads, and Failures. In: Le Métayer, D. (ed.) ESOP 2002 and ETAPS 2002. LNCS, vol. 2305, pp. 278–294. Springer, Heidelberg (2002)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Tom Ridge
    • 1
  • Michael Norrish
    • 2
  • Peter Sewell
    • 1
  1. 1.University of Cambridge 
  2. 2.NICTA 

Personalised recommendations