The TCP Three-Way Handshake
Every TCP connection starts with three segments: the client sends SYN, the server answers SYN-ACK, the client confirms with ACK. This three-way handshake synchronises sequence numbers in both directions so every byte after can be tracked, ordered and retransmitted if lost.
The three segments, with sequence numbers
Client Server |----- SYN, seq=x ------------->| |<---- SYN-ACK, seq=y, ack=x+1 -| |----- ACK, ack=y+1 ----------->| |========= data flows ==========|
Each side picks a random initial sequence number (x, y) and acknowledges the other's, +1. From here every byte is numbered — which is how TCP guarantees ordered, reliable delivery over an unreliable network.
Why three, not two?
Both sides must prove they can send and receive. SYN proves client→server works; SYN-ACK proves server→client works; the final ACK proves the client received the server's proof. Two messages would leave the server unsure its replies arrive — and vulnerable to acting on stale or spoofed requests.
Closing the connection
Teardown uses four segments: each side sends FIN and receives an ACK independently, because each direction closes separately (half-close). A crashed peer is handled by RST, the abrupt reset.
The security angle: SYN floods
A SYN flood sends thousands of SYNs and never completes step 3, filling the server's half-open connection table — a classic DoS technique. Defences include SYN cookies and connection-rate limits, and it's a favourite SOC-analyst exam topic.
Frequently asked questions
What are the three steps of the TCP handshake?
SYN from the client, SYN-ACK from the server, ACK from the client. It synchronises initial sequence numbers in both directions before any data flows.
What is the difference between SYN and ACK?
SYN (synchronise) proposes a starting sequence number for one direction; ACK (acknowledge) confirms receipt of the other side's bytes by number. The middle segment sets both flags at once.
Why does TCP need a handshake but UDP doesn't?
TCP guarantees ordered, reliable delivery, which requires both sides to agree on sequence numbers first. UDP makes no such guarantees, so it just sends — lower latency, no setup.
What is a SYN flood?
An attack that sends many SYNs without ever completing the handshake, exhausting the server's half-open connection queue so legitimate clients cannot connect.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.