Skip to main content
protocols.pageprotocols.page
networking

Three-Way Handshake

The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a connection between client and server. It synchronizes sequence numbers, negotiates options (MSS, window scale, SACK, timestamps), and costs exactly 1 RTT before data can flow. TLS adds 1-2 more RTTs on top.

Definition

TCP connection establishment requires three packets: the client sends SYN with its Initial Sequence Number (ISN) and options, the server responds with SYN-ACK (its own ISN + ACK of client's ISN + its options), and the client completes with ACK (may include data with TCP Fast Open). The handshake serves multiple purposes: confirms both endpoints are reachable, synchronizes sequence numbers for reliable delivery, and negotiates connection parameters. Options negotiated include: MSS (maximum segment size), window scale factor, SACK permitted, and timestamps. The handshake takes 1 RTT – on a 100ms path, that is 100ms before any application data flows. TCP Fast Open (RFC 7413) allows data in the SYN for repeat connections, eliminating the handshake RTT. QUIC combines transport and TLS handshakes into a single RTT (0-RTT for resumption).

Examples

  • –tcpdump -c 3 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' captures handshake
  • –SYN → SYN-ACK → ACK: sequence numbers synchronized in 1 RTT
  • –TCP Fast Open: data in SYN packet for repeat connections (RFC 7413)

Related Protocols

tcp

Related Terms

ACK (Acknowledgment)

ACK (acknowledgment) is a TCP flag confirming receipt of data. The ACK number indicates the next byte the receiver expects. Delayed ACKs batch confirmations for efficiency (typically every 2 segments or 200ms). Missing ACKs trigger retransmission – the sender assumes data was lost.

SYN (Synchronize)

SYN is a TCP flag used to initiate a connection via the three-way handshake: SYN, SYN-ACK, ACK. The SYN packet carries the client's initial sequence number (ISN). SYN floods are a classic DDoS attack that exhausts server connection tables by sending SYNs without completing handshakes.

Four-Way Teardown

TCP four-way teardown (FIN, ACK, FIN, ACK) gracefully closes a connection. Each side independently signals it has no more data (FIN) and acknowledges the other's FIN. The initiator enters TIME_WAIT for 2*MSL (60-120s) after close, consuming a socket until the timer expires.