TCP Handshake and Connection Lifecycle

Welcome to your first lesson in the course on backend engineering for interviews! We're kicking off with the "Networking and OS Foundations" module. While as backend developers we often work with higher-level abstractions like HTTP frameworks and libraries, a solid grasp of the underlying protocols is a key differentiator in interviews and in practice. It allows you to debug complex issues, optimize performance, and design more resilient systems.

Today, we will focus on the bedrock of most internet communication: the Transmission Control Protocol (TCP). Specifically, our goal is to explain the TCP three-way handshake and the full connection lifecycle. We'll cover how two computers reliably establish a connection, transfer data, and then gracefully tear it down.

The Problem: An Unreliable Network

Before we dive into the mechanics of TCP, it's crucial to understand the problem it solves. The Internet Protocol (IP), which is responsible for routing packets of data across networks, operates on a "best-effort" delivery model. This means it doesn't guarantee that packets will arrive, that they will arrive in the correct order, or that they won't be duplicated.

For most applications, like browsing a website or sending an email, this is unacceptable. We need a guarantee of reliability. This is where TCP comes in. It sits on top of IP and adds the necessary logic to turn an unreliable packet delivery service into a reliable, ordered stream of data.

To understand the core motivations behind TCP's design, let's watch a short video.

What is the TCP 3-Way Handshake and Why Backend Engineers should understand it

The video "What is the TCP 3-Way Handshake and Why Backend Engineers should understand it" by Hussein Nasser provides excellent context. Pay close attention to his explanation of the fundamental problems of packet loss and out-of-order delivery, and how concepts like acknowledgments and sequence numbers are introduced to solve them.

Please watch from the beginning, focusing on the sections that explain the need for acknowledgements and sequence numbers to handle packet loss and ordering. Then, continue watching as he explains the necessity of synchronizing these sequence numbers between the client and server, which is the primary reason for the handshake.

As the video explains, to ensure reliable, ordered delivery, the client and server need to agree on a starting point for their communication. They each need to establish and communicate an initial sequence number. This synchronization process is the famous three-way handshake.

The TCP Connection Lifecycle

A TCP connection has three distinct phases:

Establishment: The three-way handshake.
Data Transfer: The exchange of application data.
Termination: The four-way handshake to close the connection.

Let's walk through this entire process step-by-step. The following video by Ben Eater provides an exceptionally clear and detailed walkthrough of a complete TCP session.

TCP connection walkthrough | Networking tutorial (13 of 13)

This video, "TCP connection walkthrough", meticulously illustrates each phase of the connection. It uses simplified sequence numbers (starting from 0) which makes it much easier to follow the logic.

Please watch the following segments: The Three-Way Handshake: This part details the establishment phase. Observe how the SYN and ACK flags are used, and how the sequence and acknowledgment numbers are exchanged. Data Transfer: Watch how data is sent and how the receiver uses the acknowledgment number to confirm receipt of a specific number of bytes. The Four-Way Handshake: This segment explains the termination phase. Notice how each side must independently signal that it is finished sending data using the FIN flag.

Deconstructing the Lifecycle

Now that you've seen the full lifecycle in action, let's solidify the key concepts with a diagram and a more detailed textual explanation.

This diagram provides a great visual summary of the three main phases of a TCP connection: the 3-way handshake for establishment, data transfer with acknowledgements, and the 4-way handshake for termination.

1. Establishment: The Three-Way Handshake

As you saw, this process involves three packets:

SYN: The client, wishing to start a connection, sends a packet with the SYN (synchronize) flag set and a randomly chosen Initial Sequence Number (ISN), let's call it client_isn. The client then enters the SYN_SENT state.
- Client -> Server: SYN (seq=client_isn)
SYN-ACK: The server, upon receiving the SYN packet, allocates resources for the connection. It responds with a packet that has both the SYN and ACK (acknowledge) flags set.
- It sets its own random Initial Sequence Number, server_isn.
- It acknowledges the client's SYN by setting the acknowledgment number to client_isn + 1.
- The server then enters the SYN_RCVD state.
- Server -> Client: SYN (seq=server_isn), ACK (ack=client_isn + 1)
ACK: The client receives the SYN-ACK packet. It acknowledges the server's SYN by sending a final ACK packet.
- The acknowledgment number is set to server_isn + 1.
- The client enters the ESTABLISHED state. When the server receives this ACK, it also enters the ESTABLISHED state.
- Client -> Server: ACK (ack=server_isn + 1)

At this point, the connection is open, and both sides are ready to send and receive data.

A very common interview question is: "Why is a three-way handshake necessary? Why not two?" The next reading will answer this question in detail.

In-depth understanding of 3-Way Handshake Connection and ...

This article provides a concise yet thorough explanation of the handshake, including the client/server state transitions and the rationale behind the design.

First, review the section titled "3-Way Handshake". Focus on the Handshake Process to reinforce your understanding of the steps and the corresponding states (SYN-SENT, SYN-RCVD, ESTABLISHED). Then, critically, read the subsection Why is it necessary to do three times?. The key reasons are to prevent confusion from old, delayed connection requests and to ensure both sides have successfully synchronized their sequence numbers.

2. Data Transfer

Once the connection is ESTABLISHED, data can flow in both directions. Every chunk of data is sent in a TCP segment, which has a sequence number. The receiver uses an acknowledgment number in its reply to inform the sender of the next sequence number it expects. This confirms that all prior data has been received correctly. If the sender doesn't receive an ACK for a segment within a certain time, it retransmits the data, ensuring reliability.

3. Termination: The Four-Way Handshake

Because a TCP connection is full-duplex (data can flow in both directions independently), each direction must be closed independently. This results in a four-step process.

FIN: The side that wants to close the connection (let's say the client) sends a packet with the FIN (finish) flag set. This means, "I am done sending data." The client enters the FIN_WAIT_1 state.
ACK: The server receives the FIN and sends an ACK packet to acknowledge it. The server now knows the client won't send more data, but the server can still send data if it needs to. The server enters the CLOSE_WAIT state.
FIN: Once the server has finished sending its own data, it sends its FIN packet to the client. This means, "I am also done sending data." The server enters the LAST_ACK state.
ACK: The client receives the server's FIN and sends a final ACK to acknowledge it. After sending this, the client enters a TIME_WAIT state (to handle any lingering packets), and after a timeout, the connection is fully closed. When the server receives this final ACK, it closes the connection immediately.

The following diagram shows these states and exchanges more formally.

This sequence diagram illustrates the complete TCP connection and termination process, including the specific states each side transitions through, such as SYN_SENT, ESTABLISHED, FIN_WAIT_1, and CLOSE_WAIT.

Key Takeaways

TCP provides a reliable, ordered, and connection-oriented communication channel over the unreliable IP network.
The three-way handshake (SYN, SYN-ACK, ACK) is essential to establish a connection. Its primary purpose is to synchronize the initial sequence numbers from both the client and server and to ensure both parties are ready to communicate.
The connection lifecycle consists of three phases: establishment, data transfer, and termination.
The four-way handshake (FIN, ACK, FIN, ACK) is used to gracefully close a connection, allowing each side to terminate its end of the connection independently.

Understanding this lifecycle is fundamental. When you debug a backend service that is slow to connect to a database, the issue could be network latency causing a slow handshake. When designing a system, knowing the overhead of establishing TCP connections might lead you to use connection pooling, a topic we'll cover later.

In our next lesson, we will compare TCP to its main alternative, UDP, and explore the crucial tradeoffs between them. This will help you understand when to use one over the other in different backend scenarios.

Recommended resources