TCP Three-Way Handshake & Connection State

Lesson Overview & Learning Objectives

The Internet Protocol (IP) at Layer 3 is best-effort and unreliable: packets can be lost, corrupted, duplicated, or delivered out of order. To build reliable software applications, the internet relies on the Transmission Control Protocol (TCP) at Layer 4. Before transmitting a single byte of application data, TCP establishes a stateful, bidirectional, byte-oriented connection through the celebrated Three-Way Handshake. In this deep dive, we dissect packet control flags, examine initial sequence number generation, explore sliding window flow control, and walk through graceful connection teardowns.

1. The Need for a Handshake: Synchronization & State

Unlike stateless protocols like UDP, TCP guarantees three fundamental properties:

Guaranteed Delivery

Every byte transmitted must be explicitly acknowledged by the receiver; unacknowledged segments are automatically retransmitted after a calculated RTO (Retransmission Timeout).

Ordered Sequencing

Because datagrams can take different physical routes across the internet, TCP reorders out-of-order segments into the exact sequence byte stream intended by the sender.

Buffer Overrun Protection

Through the Receive Window (rwnd), a fast sender is prevented from overwhelming a slow receiver's operating system memory buffers.

2. The Three Steps of the Handshake: SYN, SYN-ACK, ACK

The handshake coordinates communication between two endpoints transitioning across kernel states:

Step 1: Client → Server [SYN] Client State: SYN_SENT

The client chooses a pseudo-random Initial Sequence Number (ISN), denoted Seq = X. It sets the SYN (Synchronize) control flag in the TCP header and sends the segment to the server's listening port (e.g. port 80 or 443).

Step 2: Server → Client [SYN, ACK] Server State: SYN_RECEIVED

The server receives the SYN. It acknowledges the client's sequence by setting Ack = X + 1 and sets the ACK flag. Simultaneously, the server chooses its own independent random Initial Sequence Number, Seq = Y, and sets its SYN flag.

Step 3: Client → Server [ACK] Both States: ESTABLISHED

The client acknowledges the server's sequence number by sending a segment with Ack = Y + 1 and the ACK flag. At this exact instant, the TCP connection is fully ESTABLISHED. (Crucially, the client can already append HTTP request payload data inside this third segment!)

3. TCP Header Flags Decoded

Flag	Name	Function
SYN	Synchronize	Initiates a connection; synchronizes sequence numbers between hosts
ACK	Acknowledgment	Confirms receipt of data bytes up to the indicated acknowledgment number
FIN	Finish	Gracefully closes one direction of the byte stream when a host has finished writing
RST	Reset	Abruptly terminates an invalid or rejected connection (e.g. port not open)
PSH	Push	Instructs receiver kernel to push buffered bytes to userland immediately
URG	Urgent	Points to out-of-band urgent data requiring prioritized processing

4. Connection Teardown: The Four-Way Handshake

Because TCP connections are full-duplex (allowing both sides to send and receive simultaneously), closing a connection requires each direction to terminate independently:

Client sends FIN: Client announces it has finished transmitting data (enters FIN_WAIT_1).
Server sends ACK: Server acknowledges client's FIN (client enters FIN_WAIT_2, server enters CLOSE_WAIT).
Server sends FIN: Once server completes pending writes, it sends its own FIN (enters LAST_ACK).
Client sends ACK: Client acknowledges server's FIN and enters the TIME_WAIT state (usually 2 × MSL or 60 seconds) to ensure delayed duplicate packets clear the network before the port can be reused.