TCP 3 Way Handshake: Reliable Connection Establishment

Prerequisites: Basic Understanding of TCP/IP, IP Addresses and Network Ports

Imagine you open a website using your computer.

Before your browser can exchange information with a web server over a normal TCP connection, the client and server must first establish that connection.

But how does the server know that the client wants to communicate?

How does the client know that the server has accepted the connection?

And how do both systems prepare to exchange data reliably?

This process is called the TCP Three-Way Handshake.

TCP stands for Transmission Control Protocol.

It is a connection-oriented transport protocol designed to provide reliable, ordered delivery of a stream of bytes between communicating applications.

TCP uses three messages—SYN, SYN-ACK and ACK—to establish a connection.

When communication is finished, TCP can close the connection gracefully through a process commonly called Four-Way Connection Termination.

In this article, you will learn:

• What the TCP three-way handshake is
• How SYN, SYN-ACK and ACK work
• How TCP sequence and acknowledgment numbers are used
• How to recognize a handshake in Wireshark
• How TCP connections close using FIN and ACK
• Important TCP connection states
• Common handshake and termination problems

What Is the TCP Three-Way Handshake?

The TCP three-way handshake is the connection establishment process used by TCP.

It is defined in IETF RFC 9293 — Transmission Control Protocol (TCP).

The handshake allows two TCP endpoints to synchronize their initial sequence numbers and establish the communication state needed for a TCP connection.

Why Does TCP Need a Handshake?

Before exchanging normal application data, TCP endpoints need to establish connection state.

The handshake helps them:

• Exchange and acknowledge initial sequence numbers
• Confirm that the remote TCP endpoint is responding
• Exchange supported TCP connection options
• Initialize connection-related state and resources
• Prepare for reliable, ordered communication

Understanding Important TCP Flags

TCP uses control flags to manage communication.

A TCP segment may have more than one flag set.

For example, a SYN-ACK segment has both the SYN and ACK flags enabled.

How the TCP Three-Way Handshake Works

The handshake consists of three main steps.

Step 1 — SYN: Client Requests a Connection

The client begins by sending a TCP segment with the SYN flag enabled.

The SYN contains an Initial Sequence Number (ISN).

The ISN is selected to support correct sequencing and resistance to sequence-number prediction attacks.

For this example:

Client Initial Sequence Number = 1000

The client sends:

Client → Server

TCP Flags: SYN
Sequence Number: 1000

The client enters the SYN-SENT state.

The server receives the connection request.

Step 2 — SYN-ACK: Server Responds

If the server accepts the connection request, it responds with a segment containing both SYN and ACK flags.

The server selects its own initial sequence number.

For example:

Server Initial Sequence Number = 5000

The server sends:

Server → Client

TCP Flags: SYN, ACK
Sequence Number: 5000
Acknowledgment Number: 1001

The acknowledgment value is 1001 because the client’s SYN consumes one position in the TCP sequence-number space.

The server enters the SYN-RECEIVED state while awaiting the final acknowledgment.

Step 3 — ACK: Client Confirms the Connection

The client receives the SYN-ACK and sends an acknowledgment.

Client → Server

TCP Flags: ACK
Sequence Number: 1001
Acknowledgment Number: 5001

The acknowledgment value is 5001 because the server’s SYN also consumes one sequence-number position.

After transmitting a valid final ACK, the client enters the ESTABLISHED state.

When the server receives and accepts that ACK, it also enters the ESTABLISHED state.

Normal application data can now be exchanged over the TCP connection.

Complete Handshake Example

These numbers are illustrative.

Real TCP initial sequence numbers are typically much larger and are selected independently by each endpoint.

Why Does the Acknowledgment Number Increase by One?

TCP sequence numbers identify positions in a stream of bytes.

Certain TCP control flags also consume sequence-number space.

In particular:

• SYN consumes one sequence-number position.
• FIN consumes one sequence-number position.
• Application data consumes sequence-number positions according to its length.
• A pure ACK without payload does not consume sequence-number space.

This explains why the acknowledgment after a SYN normally advances by one.

TCP Three-Way Handshake in Wireshark

Wireshark is a packet-analysis tool used to inspect network traffic.

It can help you identify TCP connection establishment and termination packets.

Example — Analyzing a TCP Connection

To observe a handshake:

1. Open Wireshark.
2. Select the correct network interface.
3. Start packet capture.
4. Initiate a new TCP connection to an authorized server.
5. Stop the capture after the connection is established.
6. Filter the captured TCP packets.
7. Identify the SYN, SYN-ACK and ACK sequence.

A web connection using HTTP/1.1 over TLS normally uses TCP. HTTP/3, however, uses QUIC over UDP and will not show a TCP handshake for that connection.

Useful Wireshark Display Filters

The stream number 0 is an example. Replace it with the actual TCP stream number shown in your capture.

To view a specific connection, select one of its packets, right-click and choose Follow → TCP Stream.

Wireshark can display relative sequence numbers, so an initial SYN may appear with Seq = 0 rather than its original raw sequence number.

Understanding Client-Side and Server-Side Captures

When capturing packets at the client, you normally observe:

1. Outgoing SYN
2. Incoming SYN-ACK
3. Outgoing ACK

When capturing packets at the server, you normally observe:

1. Incoming SYN
2. Outgoing SYN-ACK
3. Incoming ACK

Both captures represent the same handshake from different observation points.

Packet loss, network filtering or capture configuration can affect what appears in a particular capture.

TCP Four-Way Connection Termination Explained

After two systems finish communicating, TCP can close the connection gracefully.

This process is commonly described as the TCP Four-Way Termination.

It uses FIN and ACK flags.

TCP communication is bidirectional, meaning each endpoint can send data independently.

Therefore, each direction can be closed separately.

Step 1 — FIN: Client Initiates Closure

Suppose the client has finished sending data.

It sends a FIN to the server.

Example:

Client → Server

TCP Flags: FIN, ACK
Sequence Number: 2000

The client enters FIN-WAIT-1.

The FIN means the client will send no more data in that direction.

It does not necessarily mean that the server has finished sending data.

Step 2 — ACK: Server Acknowledges the FIN

The server acknowledges the client’s FIN.

Server → Client

TCP Flags: ACK
Acknowledgment Number: 2001

The server enters CLOSE-WAIT.

After the client receives the acknowledgment for its FIN, it enters FIN-WAIT-2.

The server may still send remaining application data before closing its own sending direction.

Step 3 — FIN: Server Initiates Its Closure

When the server has finished sending, it sends its own FIN.

Server → Client

TCP Flags: FIN, ACK
Sequence Number: 6000

The server enters LAST-ACK while waiting for acknowledgment of its FIN.

Step 4 — ACK: Client Confirms Closure

The client acknowledges the server’s FIN.

Client → Server

TCP Flags: ACK
Acknowledgment Number: 6001

The client enters TIME-WAIT.

When the server receives the final ACK, it can transition to CLOSED.

The client remains in TIME-WAIT for the required waiting period before fully releasing the connection state.

TCP Termination Example

This is the common four-segment termination sequence.

It is not mandatory for every TCP connection to close using exactly four separate segments.

For example, the server may combine acknowledgment of the client’s FIN with its own FIN.

Simultaneous closure and abrupt connection resets also produce different packet sequences.

What Is the TIME-WAIT State?

TIME-WAIT is a TCP state used after certain graceful connection closures.

It helps:

• Allow retransmission of the final ACK if necessary
• Prevent delayed segments from an earlier connection from interfering with a later connection using the same endpoint identifiers

The TCP specification describes a 2 × Maximum Segment Lifetime (2 MSL) waiting period.

The effective duration depends on the TCP implementation and operating system.

Common TCP Handshake and Termination Problems

TCP connection establishment and termination are useful areas to investigate during network troubleshooting.

Common Problems

Basic Troubleshooting Method

When a TCP connection fails:

1. Check whether the client sends a SYN.
2. Determine whether the server responds with SYN-ACK, RST or no visible response.
3. Check whether the final ACK completes the handshake.
4. Review firewall rules, NAT behavior and routing paths.
5. If the handshake succeeds, investigate the subsequent application communication.

A missing packet in a capture does not always mean the packet was never transmitted. The packet may have been lost, filtered or missed by the capture point.

Key Takeaways

TCP Connection Establishment

• TCP uses SYN, SYN-ACK and ACK to establish a connection.
• Both endpoints select initial sequence numbers.
• SYN consumes one TCP sequence-number position.
• Both endpoints reach ESTABLISHED after completing their respective handshake processing.
• TCP reliability involves additional mechanisms beyond the handshake.

TCP Connection Termination

• Graceful termination commonly uses FIN, ACK, FIN and ACK.
• Each TCP sending direction can close independently.
• FIN consumes one sequence-number position.
• TIME-WAIT supports reliable connection cleanup.
• TCP connections can also terminate through different packet sequences or resets.

Packet Analysis and Troubleshooting

• Wireshark can display TCP flags, sequence numbers and acknowledgment numbers.
• Client-side and server-side captures show opposite packet directions.
• SYN retransmissions may indicate connectivity or response problems.
• A successful handshake does not guarantee successful application communication.

TCP is one of the foundational protocols of modern computer networking.

Its three-way handshake enables two endpoints to establish communication and synchronize their initial sequence numbers before exchanging normal application data.

Its graceful termination process allows each endpoint to finish sending data and release connection state in an orderly manner.

Understanding SYN, SYN-ACK, ACK, FIN, RST and TCP states is particularly useful when troubleshooting firewalls, load balancers, proxies, servers and network connectivity issues.

For network engineers, these concepts provide the foundation for analyzing TCP packet captures and understanding how connection-oriented communication operates.

Useful Links and References

SanchitGurukul Resources

Official External References