Walk through the TCP three-way handshake. What three packets are sent, and what does each accomplish?

SYN → SYN-ACK → ACK. Both sides exchange initial sequence numbers and confirm they can both send AND receive.

* The four-way teardown that complements the SYN handshake. *

* The SYN / SYN-ACK / ACK exchange that opens a TCP connection. — Fleshgrinder, Public domain, via Wikimedia Commons. *

The three steps:

Client                              Server
  |                                    |
  | -------- SYN, Seq=X --------->     |    Step 1: Client says "let's talk, my seq starts at X"
  |                                    |
  |    <--- SYN, ACK, Seq=Y, Ack=X+1   |    Step 2: Server says "OK, mine starts at Y, I got your X"
  |                                    |
  | ----- ACK, Seq=X+1, Ack=Y+1 ->     |    Step 3: Client confirms "got your Y"
  |                                    |
  |        Connection established      |

What each flag means:

• SYN = Synchronize — "I want to start a connection, here's my initial sequence number"
• ACK = Acknowledge — "I received your data up to byte N"
• SYN+ACK = Both flags set — "I synchronize back AND acknowledge yours"

Why three packets, not two:

Each side needs to verify both directions work:

1. SYN proves Client → Server works (server received it)
2. SYN-ACK proves Server → Client works (client receives this)
3. ACK proves Client → Server works for the second time, confirming the client received the SYN-ACK

This solves the Two Generals Problem — both sides must agree communication exists. Three messages is the minimum to establish mutual confidence.

Sequence numbers:

• Random initial values (chosen for security — predictable ISNs allow injection attacks)
• After handshake: Seq counts bytes sent. Ack counts bytes received +1 (= "next byte expected")

Connection teardown is a four-way handshake:

FIN → ACK → FIN → ACK — each side closes its half independently. This is why TCP can do "half-open" connections.

Tip: SYN floods abuse this — attacker sends many SYNs but never the final ACK. The server keeps half-open connections in memory until they time out, exhausting resources. Defense: SYN cookies.

Go deeper:

• TCP connection establishment (Wikipedia) — the SYN / SYN-ACK / ACK exchange and teardown, with the sequence-number bookkeeping spelled out.
• RFC 9293 — Transmission Control Protocol — the current authoritative spec (replaces RFC 793); the state machine here is the canonical reference.