TCP 3-Way Handshake

Why a handshake?

TCP (Transmission Control Protocol) promises reliable, ordered delivery over an unreliable network. To do that, both sides number every byte they send with sequence numbers, and acknowledge what they receive with ACK numbers.

Before sending data, the two computers must agree on their starting sequence numbers. That agreement is the 3-way handshake.

The three steps

Client                                    Server (LISTEN)
  |  ---- SYN, seq = x ----------------->   |      client: SYN-SENT
  |  <--- SYN-ACK, seq = y, ack = x + 1 --  |      server: SYN-RECEIVED
  |  ---- ACK, seq = x + 1, ack = y + 1 -->  |      both: ESTABLISHED

1. SYN — “I want to connect; my first sequence number is x.”
2. SYN-ACK — “OK. I got x (I expect x + 1 next), and my first number is y.”
3. ACK — “Got y. Let’s go.”

Starting numbers are random, which protects against confusing old, delayed packets with a new connection (and against some attacks).

Why not two steps?

With only SYN and SYN-ACK, the server would never know whether its own starting number y reached the client. Each side needs to send its number and see it acknowledged — that takes three messages.

Data transfer

Every data segment carries a sequence number; the receiver replies with an ACK = next byte expected. If the client sends 100 bytes starting at 101, the server answers ack = 201. Missing ACKs trigger retransmission. To avoid waiting for every single ACK, TCP keeps several segments in flight using a sliding window.

Closing: the 4-way handshake

Each direction is closed separately:

1. Client → FIN (I’m done sending) → FIN-WAIT-1
2. Server → ACK → server CLOSE-WAIT, client FIN-WAIT-2
3. Server → FIN (I’m done too) → LAST-ACK
4. Client → ACK → client waits in TIME-WAIT (to catch a lost final ACK), then both CLOSED

Key TCP states

See it on your own computer

# Linux / macOS: list TCP connections and their states
netstat -an | grep -E "LISTEN|ESTABLISHED"

A tiny TCP client in Python — the handshake happens inside connect():

import socket
s = socket.create_connection(("example.com", 80))   # SYN, SYN-ACK, ACK happen here
s.sendall(b"GET / HTTP/1.0\r\nHost: example.com\r\n\r\n")
print(s.recv(200))
s.close()                                           # FIN / ACK exchange

TCP vs UDP

Common mistakes

• Forgetting the +1 in ACK numbers (a SYN or FIN counts as one sequence number).
• Mixing up which side sends the SYN-ACK (always the side that received the SYN).
• Thinking closing also takes three messages — it usually takes four.