Overview
Before TCP can reliably move data, both ends must agree to talk and synchronize their starting state. That agreement is the three-way handshake — the opening exchange of every TCP connection. This lesson walks through the handshake step by step.
Learning objectives
- Describe the three steps of the TCP handshake.
- Explain the purpose of SYN and ACK flags and sequence numbers.
- Connect the handshake to connection-oriented reliability.
Core concept
TCP is connection-oriented: it establishes a session before exchanging data. The three-way handshake sets up that session and synchronizes sequence numbers so each side can track and order bytes. It uses TCP control flags, chiefly SYN (synchronize) and ACK (acknowledge).
The three steps:
- SYN — the client sends a segment with the SYN flag set and its initial sequence number.
- SYN-ACK — the server replies with SYN and ACK set, acknowledging the client's sequence number and sending its own.
- ACK — the client acknowledges the server's sequence number. The connection is now established.
How it works
Each side chooses a random initial sequence number (ISN) and tells the other about it during the handshake. Acknowledgements confirm receipt by referencing the next expected sequence number. Once all three steps complete, both ends know each other's starting point and are ready to exchange data reliably. A connection is later closed with a separate exchange (FIN/ACK), a graceful teardown distinct from the opening handshake.
Practical example
Opening a web page triggers a handshake to the server's port 443: your machine sends SYN, the server answers SYN-ACK, and your machine sends ACK — all before the first byte of the HTTPS request is sent. In a packet capture you can literally see these three segments at the start of every TCP connection, marking where the session begins.
Cybersecurity relevance
The handshake is a rich source of security signal. A SYN scan sends SYNs and inspects the responses to map open ports without completing connections. A SYN flood is a denial-of-service attack that sends many SYNs but never the final ACK, exhausting the server's table of half-open connections. Recognizing incomplete or abnormal handshakes is a core detection skill for analysts.
Common mistakes
- Miscounting the steps — it is three messages (SYN, SYN-ACK, ACK), not two or four.
- Confusing connection setup with teardown — closing uses FIN, not another SYN handshake.
- Ignoring sequence numbers — they are the whole point of synchronizing, enabling ordering and reliability.
Key takeaways
- TCP is connection-oriented; every session opens with a three-way handshake.
- The steps are SYN → SYN-ACK → ACK, exchanging and acknowledging each side's initial sequence number.
- Half-open or incomplete handshakes underlie SYN scans and SYN-flood attacks.
Check your understanding
- Name the three handshake messages in order and which flags each carries.
- Why does a SYN flood harm a server, in terms of what the handshake normally completes?