TCP Handshake and Teardown

1. The Foundation: Establishing a TCP Connection

Before two applications can send data to each other using TCP, they must establish a connection. TCP is a connection-oriented protocol, meaning it sets up a dedicated communication session. This is achieved through a process called the three-way handshake. Its main purpose is to synchronize the sequence numbers on both sides of the connection, ensuring that no data is lost or duplicated.

To get a clear, high-level overview of this process, please read the first part of the following article.

As you just read, the process involves three key steps:

1. SYN: The client initiates the connection by sending a segment with the SYN (Synchronize) flag set. This packet includes an Initial Sequence Number (ISN), which is a random number that will be used to track the data it sends.
2. SYN-ACK: The server responds with a segment that has both the SYN and ACK (Acknowledge) flags set.
   • The SYN part contains the server's own ISN.
   • The ACK part acknowledges the client's SYN by sending back the client's ISN plus one ($\text{client\_ISN}+1$).
3. ACK: The client completes the handshake by sending a final ACK segment. This acknowledges the server's SYN by sending back the server's ISN plus one ($\text{server\_ISN}+1$).

At this point, the connection is established, and both sides are ready to transfer data.

The Control Flags

This entire process is orchestrated by specific bits in the TCP header called control flags. To understand their role, let's briefly look at what they are.

2. A Deeper Look at the Handshake

Now that you have the basic structure, let's examine the mechanics in more detail, particularly concerning sequence and acknowledgment numbers. The following video provides an excellent, in-depth explanation.

The key takeaway is that the handshake isn't just about saying "hello"; it's a negotiation to set the rules for the conversation that's about to happen. Both sides agree on starting sequence numbers and other parameters to ensure the subsequent data transfer is reliable and efficient.

3. Graceful Goodbye: Terminating the Connection

Once the data transfer is complete, the connection must be closed gracefully. This is where the connection teardown process comes in, which typically involves a four-way handshake. Each side of the connection must terminate independently.

Let's return to the first article for a concise overview of this process.

The process generally unfolds as follows, using the FIN (Finish) flag to signal the end of data transmission:

1. FIN: The client, having finished sending its data, sends a segment with the FIN flag set.
2. ACK: The server acknowledges the client's FIN. At this point, the server can still send data to the client if it needs to (this is known as a "half-closed" state).
3. FIN: Once the server is also ready to close the connection, it sends its own FIN segment.
4. ACK: The client acknowledges the server's FIN, and after a brief waiting period (to ensure the ACK wasn't lost), the connection is fully closed on both ends.

Similar to the SYN flag, the FIN flag also consumes a sequence number. This means that when a device receives a FIN, its acknowledgment number will be the sequence number of the FIN packet plus one.

The following video segment illustrates this four-packet exchange clearly.

4. Seeing it Live: The Handshake in Wireshark

Theory is essential, but seeing these packets in a real-world tool makes the concepts stick. Wireshark is a packet capture and analysis tool that you will use frequently as a network professional.

Let's watch how Jeremy's IT Lab identifies the three-way handshake and connection teardown in a live Wireshark capture.

Practical Activity (Optional but Recommended)

To solidify your understanding, I highly recommend you try this yourself.

1. Download and install Wireshark. It's a standard industry tool and completely free.
2. Start a packet capture on your main network interface (e.g., Wi-Fi or Ethernet).
3. Open a web browser and visit any http:// website (using https:// encrypts the traffic, making it harder to analyze for now). A good example is http://neverssl.com.
4. Stop the capture and use the filter tcp in Wireshark.
5. Look through the packets and try to find a three-way handshake and a four-way teardown for your connection.

Conclusion

In this lesson, we've broken down the lifecycle of a TCP connection. This foundational knowledge is critical for understanding how most applications on the internet communicate reliably.

Here are the key takeaways:

• TCP establishes connections using a three-way handshake (SYN, SYN-ACK, ACK) to synchronize sequence numbers between the client and server.
• Connections are closed using a four-way handshake (FIN, ACK, FIN, ACK), allowing each side to terminate independently.
• The SYN, ACK, and FIN control flags in the TCP header are the signals that orchestrate this entire process.
• Tools like Wireshark allow you to observe these packet exchanges in real-time, moving from theory to practical analysis.

In our next lesson, we will compare TCP with its lightweight, connectionless counterpart: UDP. We'll explore the structure of both TCP and UDP segments and discuss when it's appropriate to use one over the other.