Wireshark TCP Handshake Analysis

1. The Three-Way Handshake: A Quick Refresher

Before we open Wireshark, let's quickly review the purpose of the three-way handshake. It's designed to ensure that both the client and server are ready to communicate and have synchronized their initial sequence numbers.

Here are the three steps:

1. [SYN] Client → Server: The client initiates the connection by sending a TCP segment with the SYN (Synchronize) flag set. This packet essentially says, "I'd like to connect. My starting sequence number is X."
2. [SYN, ACK] Server → Client: The server, if it's ready to accept the connection, replies with a segment that has both the SYN and ACK (Acknowledge) flags set. This packet says, "I acknowledge your request (your sequence number X+1), and I'm also ready to connect. My starting sequence number is Y."
3. [ACK] Client → Server: Finally, the client sends a segment with the ACK flag set to acknowledge the server's sequence number. This packet says, "I acknowledge your sequence number Y+1. The connection is now established."

After this exchange, both sides are in the ESTABLISHED state (which you saw in netstat), and data transfer can begin.

To see this explained visually, please watch the first part of the following video. It does an excellent job breaking down the role of sequence and acknowledgment numbers.

2. Hands-On Lab: Capturing Your First Handshake

Now it's time to put theory into practice. In this section, you'll use Wireshark to capture a live TCP handshake.

Step 1: Prepare Your Tools

First, you'll need Wireshark installed on your system. If you don't have it, you can download it from wireshark.org.

You'll also need a way to generate simple, unencrypted web traffic. The curl command-line tool, which is built into macOS, Linux, and modern Windows, is perfect for this.

Step 2: Start the Capture

1. Open Wireshark. You'll be greeted with a list of network interfaces (e.g., "Wi-Fi," "Ethernet").
2. Select the active interface. Choose the one that you use to connect to the internet. It will usually have a sparkline graph next to it showing live traffic.
3. Start the capture by double-clicking the interface name or by selecting it and clicking the blue shark fin icon. You'll see packets start to fly by.
4. Apply a display filter. To clear out the noise, type tcp.port == 80 into the display filter bar at the top and press Enter. This tells Wireshark to only show you packets traveling to or from port 80 (the standard port for HTTP).

Step 3: Generate Traffic

With the capture running, open your terminal or command prompt and run the following command:

curl http://example.com

This command makes a simple HTTP request to example.com. Because we're using http (not https), the traffic is unencrypted and perfect for our analysis.

Step 4: Stop and Analyze

1. Immediately after the curl command finishes, go back to Wireshark and stop the capture by clicking the red square button.
2. You should now see a short list of packets. Look for the first three:
   • A packet with [SYN] in the "Info" column. This is your client's request.
   • A packet with [SYN, ACK] in the "Info" column. This is the server's response.
   • A packet with [ACK] in the "Info" column. This is your client's final acknowledgment.

Congratulations, you've captured a three-way handshake!

3. Dissecting the Packets

Now let's examine the details to confirm what happened. The next segment of the video you watched earlier provides a great walkthrough of this exact process.

Now, try this on your own capture.

1. Select the [SYN] packet (the first one).

   • In the packet details pane, expand the "Transmission Control Protocol" section.
   • Find the Flags field. You'll see that the Syn bit is set.
   • Find the Sequence number. Wireshark conveniently shows this as a relative number, 0, to make it easy to follow.

2. Select the [SYN, ACK] packet (the second one).

   • Expand the TCP section.
   • Notice the Flags: both Syn and Ack are set.
   • Look at the Acknowledgment number. It should be 1 (your client's relative sequence number 0 + 1).
   • Look at the Sequence number. This is the server's own starting sequence number, which Wireshark also shows as a relative 0.

3. Select the [ACK] packet (the third one).

   • Expand the TCP section.
   • Notice the Flags: only Ack is set.
   • Look at the Acknowledgment number. It should be 1 (the server's relative sequence number 0 + 1).

By following these numbers, you've just traced the synchronization and acknowledgment process that underpins every reliable TCP connection on the internet.

For a more detailed textual guide that you can refer back to, the following article provides a superb step-by-step walkthrough.

Conclusion

In this lesson, you moved from observing connection states with netstat to capturing the process of connection establishment with Wireshark. You saw firsthand how the exchange of three simple packets—SYN, SYN-ACK, and ACK—lays the foundation for reliable data transfer over TCP.

Key Takeaways:

• The three-way handshake is used to synchronize sequence numbers and verify that both hosts are ready to communicate.
• Wireshark can capture live network traffic, and display filters (like tcp.port == 80) are essential for isolating the packets you want to analyze.
• The Info column in Wireshark helps you quickly identify the packets of the handshake.
• By inspecting the TCP header of each packet, you can verify the sequence of flags (SYN, SYN-ACK, ACK) and the logic of the sequence and acknowledgment numbers.

Preview of the Next Lesson:

We've seen how a connection is established at the packet level. But how does an application on your computer—like a web browser or a program you write—tell the operating system to create these packets? The answer lies in the Socket API. In the next lesson, we will begin our journey into network programming by exploring the concept of a socket and the sequence of function calls a C program uses to create, manage, and use these network connections.