The "Hello" Dance
Before TCP can send a single byte of reliable data, the two communicating computers must formally agree to talk. This agreement is called the Three-Way Handshake. It serves two purposes: it establishes that both sides are reachable and ready, and it synchronizes the sequence numbers that TCP uses to track which data has been delivered.
TCP packets carry control flags in their headers. The two relevant ones here are:
- SYN (Synchronize): "I want to start a connection and here is my starting sequence number."
- ACK (Acknowledge): "I received your last message."
The handshake proceeds in three steps:
- SYN — Client → Server: The client sends a packet with the SYN flag set and a randomly chosen starting sequence number (e.g.,
seq=100). This is the knock on the door. - SYN-ACK — Server → Client: The server receives the SYN, acknowledges it (
ack=101, meaning "I expect byte 101 next"), and sends its own SYN with its own starting sequence number (e.g.,seq=300). This is opening the door and saying "come in." - ACK — Client → Server: The client acknowledges the server's SYN (
ack=301). The connection is now fully established. This is stepping through the door.
Only after step 3 does either side begin sending application data (the actual HTTP request, SSH command, etc.).
To close a connection cleanly, TCP uses a four-step FIN handshake: one side sends FIN, the other ACKs it, then sends its own FIN, and the first side ACKs that. This allows both sides to finish sending any remaining data before closing.
Key Point: The sequence numbers exchanged during the handshake are not just formalities. They are the foundation of TCP's reliability. Every byte of data sent is numbered, and the receiver acknowledges which bytes it has received. If an acknowledgment does not arrive within a timeout window, the sender retransmits. This mechanism is what makes TCP reliable — and also what makes it vulnerable to SYN flood attacks, where an attacker sends thousands of SYN packets but never completes the handshake, exhausting the server's connection table. Modern Linux kernels mitigate this with SYN Cookies, which encode connection state into the SYN-ACK itself so no memory is allocated until the final ACK arrives.