Three-Way Handshake (TCP)

The three-way handshake is the procedure TCP uses to open a connection. The client sends a SYN, the server answers with SYN-ACK, and the client confirms with ACK. Along the way each side picks an initial sequence number and tells the other.

Why it matters

The handshake confirms that both hosts can send and receive, and agrees on sequence numbers so later data can be ordered and acknowledged. It costs one full round trip (RTT) before the first byte of application data, which is one reason distant servers feel slow to start and why connection reuse (keep-alive) helps. Options such as window size and maximum segment size are also exchanged here.

It is also an attack surface: a SYN flood sends many SYNs and never completes the last step, filling the server's half-open queue.

Example

Client -> Server: SYN, seq=1000
Server -> Client: SYN-ACK, seq=5000, ack=1001
Client -> Server: ACK, seq=1001, ack=5001

A port checker reports a port "open" when the SYN-ACK comes back. No answer suggests filtering, while an immediate RST means the port is closed.

Common mistakes

Thinking ACK means the application received data; it only confirms TCP delivered it.
Calling a port open because a ping works; ICMP and TCP are separate.
Forgetting that closing a connection uses a separate FIN exchange.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.