The TCP Three-Way Handshake Explained

1. The Purpose of the Handshake

TCP is designed to be a reliable, connection-oriented protocol. This means it creates a dedicated, end-to-end connection before any application data is transmitted. Why is this necessary?

Imagine making a phone call. You don't just pick up the phone and start speaking your message. You dial, wait for the other person to pick up and say "Hello?", you reply with your own "Hello," and only then does the conversation begin. This initial exchange confirms two key things:

1. The person you called is actually there and listening.
2. They have acknowledged that you are also on the line and ready to speak.

The TCP three-way handshake serves the exact same purpose for two computers. It ensures that both the client and the server are active, ready to receive data, and have agreed on the initial parameters for the connection.

The process involves both sides transitioning through different states. A server waiting for a connection is in a LISTEN state. The client initiates the connection, and after the three steps, both ends are in an ESTABLISHED state.

2. The Three Steps: SYN, SYN-ACK, ACK

The handshake is an exchange of three TCP segments, each with specific flags set in its header. A flag is a single bit used to signal a particular state or condition. The two most important flags for establishing a connection are:

• SYN (Synchronize): This flag signals an attempt to initiate or "synchronize" a new connection. It also synchronizes the sequence numbers.
• ACK (Acknowledge): This flag indicates that the acknowledgment number field in the TCP header is valid. It's used to confirm receipt of a segment.

To understand how these flags and their associated numbers work, let's watch a short, clear walkthrough.

As you saw in the video, the process works like this:

1. Packet 1: The SYN (Client → Server)

   • The client wants to start a connection. It sends a TCP segment with the SYN flag set to 1.
   • It also sets its own Initial Sequence Number (ISN). This is a random number that marks the starting point for the bytes of data the client will send. Let's call it Seq=X.

2. Packet 2: The SYN-ACK (Server → Client)

   • The server receives the client's SYN. To accept the connection, it must do two things:
     • Acknowledge the client's SYN: It sends a segment with the ACK flag set. The Acknowledgment Number is set to the client's sequence number plus one (Ack=X+1). This tells the client, "I have received your first packet."
     • Send its own SYN: The server also needs to synchronize its side of the connection. It sets the SYN flag and chooses its own ISN. Let's call it Seq=Y.
   • This combined "SYN and ACK" packet is efficiently sent as a single segment.

3. Packet 3: The ACK (Client → Server)

   • The client receives the server's SYN-ACK. The connection is almost ready.
   • The client sends a final segment with the ACK flag set.
   • To acknowledge the server's SYN, it sets the Acknowledgment Number to the server's sequence number plus one (Ack=Y+1).
   • At this point, both sides have sent a SYN and received an ACK for it. The connection is officially established, and data transfer can begin.

The consumption of a sequence number by the SYN flag (incrementing the ACK number by 1) is a key detail. It signifies that the SYN flag itself occupies one "byte" in the sequence space, even though no actual application data is sent.

3. Analyzing the Handshake in Wireshark

Theory is great, but seeing this exchange live in a packet capture makes it concrete. Your interest in practical tools like Wireshark is key to truly understanding networking.

Let's start by looking at a static image of a capture.

Now, let's dig deeper. When you analyze a capture, you'll see the sequence and acknowledgment numbers. Modern operating systems use very large, random numbers for the ISNs for security reasons. To make analysis easier, Wireshark usually displays relative sequence numbers, starting them at 0 for the first packet in a stream.

The following resources will help you understand how to interpret this in practice.

With that context, let's watch a detailed breakdown of a real Wireshark capture. This will tie everything together.

Your Wireshark Analysis Checklist

Based on what you've just seen, here is what you should look for when analyzing a TCP three-way handshake in Wireshark:

1. Filter the traffic: Use the filter tcp to hide other protocols.
2. Identify the first packet (Client → Server):
   • Look for [SYN] in the Info column.
   • Expand the Transmission Control Protocol section in the packet details.
   • Expand Flags. You should see that the Syn bit is 1 (Set).
   • Note the relative Sequence number. It will be 0.
3. Identify the second packet (Server → Client):
   • Look for [SYN, ACK] in the Info column.
   • Expand Flags. Both the Acknowledgment bit and Syn bit will be 1 (Set).
   • Check the Acknowledgment number. It should be 1 (the client's sequence number 0 + 1).
   • Check the Sequence number. This is the server's initial sequence number, which Wireshark also shows as 0 (relative to the server's side of the conversation).
4. Identify the third packet (Client → Server):
   • Look for [ACK] in the Info column.
   • Expand Flags. The Acknowledgment bit will be 1 (Set).
   • Check the Acknowledgment number. It should be 1 (the server's relative sequence number 0 + 1).
   • The Sequence number will also be 1, as the client is now sending its first "real" segment after its SYN.

By following these steps, you can confidently dissect any TCP connection startup and verify that the protocol is working as expected.

Conclusion

In this lesson, you have deconstructed the TCP three-way handshake, a cornerstone of reliable internet communication. You've moved from a high-level analogy to the technical specifics of flags and sequence numbers, and finally to practical analysis in Wireshark.

Key Takeaways:

• TCP is connection-oriented, meaning it establishes a formal connection before data is sent.
• The three-way handshake (SYN, SYN-ACK, ACK) is used to establish this connection.
• The SYN flag initiates the connection and synchronizes the initial sequence number (ISN).
• The ACK flag and acknowledgment number are used to confirm receipt of segments. The rule for the handshake is Ack = received Seq + 1.
• This process ensures both the client and server are ready to communicate before any application data is exchanged.
• Tools like Wireshark allow you to observe this handshake in real-time, verifying the flags and sequence numbers for each packet.

Preview of the Next Lesson:

The handshake is just the beginning. The sequence and acknowledgment numbers it establishes are critical for TCP's main feature: reliable data delivery. In the next lesson, we will explore how TCP uses these numbers to handle lost packets, out-of-order packets, and to ensure that data arrives intact and in the correct order.