TCP Three-Way Handshake (Explained)

🔁 TCP Three-Way Handshake (Explained)

The TCP three-way handshake is the process used to establish a reliable connection between a client and a server over the Transmission Control Protocol (TCP). It ensures both sides are ready to communicate and agree on starting parameters like sequence numbers.

🔐 Why It's Important:

• Ensures both client and server are ready for communication.

• Helps synchronize sequence numbers for reliable data transfer.

• Prevents half-open or unreliable connections.

🧱 Steps of the Three-Way Handshake

1. SYN (Synchronize) — Client → Server

• The client wants to start a connection.

• It sends a SYN packet to the server.

• This packet contains an initial sequence number (ISN), which starts the conversation.

📩 Example:
Client sends:

SYN, SEQ=1000

2. SYN/ACK (Synchronize/Acknowledge) — Server → Client

• The server receives the SYN request.

• It responds with a SYN-ACK packet:

  • Acknowledges the client's SYN (ACK = client's ISN + 1)

  • Sends its own SYN with its own ISN.

📩 Example:
Server sends:

SYN, SEQ=2000, ACK=1001

3. ACK (Acknowledge) — Client → Server

• The client receives the server’s SYN/ACK.

• It sends a final ACK to:

  • Acknowledge the server's SYN (ACK = server’s ISN + 1).

• Now the connection is established.

📩 Example:
Client sends:

CopyEditACK, SEQ=1001, ACK=2001

✅ After the Handshake

At this point, both the client and the server:

• Know that the other party is responsive.

• Have agreed on initial sequence numbers.

• Are ready to begin data transmission securely and reliably.

📊 Visualization

Client                        Server  | -------- SYN -------->     |  | <----- SYN/ACK -------     |  | -------- ACK -------->     |  |     CONNECTION ESTABLISHED |

🛡️ Related to Cybersecurity

Understanding the TCP handshake is critical for:

• Detecting SYN scans (common in port scanning).

• Analyzing traffic in tools like Wireshark.

• Detecting SYN Flood attacks, a type of Denial-of-Service (DoS) where the attacker floods the server with SYN packets without completing the handshake.