A
AiTechWorlds
AiTechWorlds
Before two professionals have a serious conversation, there is a brief ritual:
"Can you hear me?" — "Yes, I can hear you. Can you hear me?" — "Yes."
Only after confirming both parties can send and receive does the real conversation begin. TCP's three-way handshake is precisely this ritual — a formal confirmation that both sides are ready to communicate before a single byte of application data is exchanged.
The handshake serves three purposes: it establishes the connection, synchronizes sequence numbers, and negotiates parameters. Miss any one of these, and data transfer becomes unreliable.
The client sends a segment with the SYN (synchronize) flag set. It includes a randomly chosen Initial Sequence Number (ISN) — let's call it x.
"I want to start a connection. My sequence numbers will start at x."
The server receives the SYN and responds with both SYN and ACK flags set. It acknowledges the client's sequence number and announces its own.
"I received your request. My sequence numbers start at y. I'm ready."
The client acknowledges the server's sequence number. The connection is now ESTABLISHED.
"Confirmed. Let's talk."
Why not two steps (SYN + SYN-ACK)?
If the server sent SYN-ACK and immediately started sending data, the client's ACK might never arrive. The server would not know whether the client was ready. Two steps give the server no confirmation.
Why not four steps?
You could separate the server's SYN and ACK into two separate messages, but there is no benefit — they can be sent simultaneously in one segment (SYN-ACK). Four steps would add unnecessary latency.
Three is the minimum number of messages that guarantees both sides have confirmed they can send and receive.
Sequence numbers are the backbone of TCP's reliability.
If segments arrive out of order (common in the internet), the receiver uses sequence numbers to reorder them before passing data to the application. If a segment is missing, the receiver signals the gap and the sender retransmits.
Closing a TCP connection requires four messages, because each side must independently close its own direction of communication.
The gap between the server's ACK and FIN exists because the server might still have data to send after the client is finished. Each direction of the full-duplex connection closes independently.
| State | Meaning |
|---|---|
| CLOSED | No connection exists |
| LISTEN | Server is waiting for incoming connections |
| SYN_SENT | Client has sent SYN, waiting for SYN-ACK |
| SYN_RECEIVED | Server received SYN, sent SYN-ACK, awaiting ACK |
| ESTABLISHED | Connection active, data transfer in progress |
| FIN_WAIT_1 | Sent FIN, waiting for ACK |
| FIN_WAIT_2 | FIN acknowledged, waiting for other side's FIN |
| CLOSE_WAIT | Received FIN, waiting for local application to close |
| LAST_ACK | Sent final FIN, waiting for last ACK |
| TIME_WAIT | Waiting 2×MSL to ensure final ACK was received |
| CLOSING | Both sides sent FIN simultaneously |
After the final ACK, the client waits 2 × MSL (Maximum Segment Lifetime) — typically 60–120 seconds — before fully closing. This ensures:
The handshake has a vulnerability: after receiving a SYN and sending SYN-ACK, the server allocates resources and waits for the ACK. If the ACK never comes, the server holds a half-open connection until it times out.
A SYN flood attack exploits this:
SYN cookies eliminate the need to store state for half-open connections:
SYN cookies are now standard in Linux and Windows kernels.
The window size field in the TCP header tells the sender how many bytes the receiver can currently accept in its buffer.
Sender: sends up to window_size bytes without waiting for ACK
Receiver: ACK says "received X, my window is now Y bytes"
This prevents a fast sender from overwhelming a slow receiver — a mechanism called flow control. It is distinct from congestion control, which responds to network capacity rather than receiver capacity.
Window Scaling (RFC 7323): The original window size field is 16 bits (max 65535 bytes). Modern networks with high bandwidth-delay products need larger windows. The window scaling option allows window sizes up to 1 GB.
Get this course's notes on Telegram!
Free cheat sheets, summaries & practice exercises