gor.bio wiki

TCP Three-Way Handshake

The three-message exchange TCP uses to open a reliable connection and synchronize sequence numbers between two hosts.

Category: Networking · Created: 2026-08-16 · Updated: 2026-08-16

Illustration: TCP Protocol Diagram
Illustration: TCP Protocol Diagram · Image: Tjhiker, CC BY-SA 3.0, via Wikimedia Commons.

Before two hosts can exchange data over TCP, they must agree on the connection parameters — above all the initial sequence numbers each side will use. The Transmission Control Protocol establishes this agreement with a three-message exchange called the three-way handshake. It is the first step of every TCP connection, from web browsing to email to file transfer.

The handshake proceeds as follows:

  1. The client sends a SYN segment, with the SYN flag set, announcing its initial sequence number x.
  2. The server replies with a SYN-ACK segment, acknowledging x + 1 and announcing its own initial sequence number y.
  3. The client sends an ACK segment acknowledging y + 1.

Each side learns two things from the exchange: that the other side is reachable and willing to communicate, and the sequence number the other side will start counting from. Once both acknowledgements have been received, the connection is in the ESTABLISHED state and data can flow in both directions simultaneously.

Sequence numbers matter because TCP is a byte-stream protocol: every byte of data is numbered, and the receiver uses the numbers to reorder out-of-order segments and to detect gaps caused by loss. The handshake fixes the starting point of that numbering on both ends. Modern TCP stacks randomize initial sequence numbers to make off-path spoofing and injection attacks harder.

The handshake costs one round trip of latency before any data can be sent, which is why short transactions over high-latency links feel slow. TCP Fast Open (TFO) reduces the cost for repeated connections by allowing data to be sent in the SYN under a cryptographic cookie. Tear-down uses a separate four-way FIN exchange because each direction of the connection is closed independently. TCP's reliability mechanisms, including retransmission and congestion control, build on the state established by the handshake; virtually all HTTP traffic depends on it.

Tags

networking protocols tcp

Related articles

This text may be freely copied, modified, and reused. See Content Reuse.