Three Way Handshaking in TCP: Definition, Steps, Examples, and Exam Notes
Introduction
In computer networks, reliable communication between a client and a server is essential. The Transmission Control Protocol (TCP) provides this reliability by establishing a connection before any data is transferred. The process used to create this connection is called three way handshaking (also written as three-way handshake). It ensures that both sides are ready, agree on initial sequence numbers, and can send and receive messages correctly. Without this handshake, data could be lost, duplicated, or delivered out of order, which would be a serious problem for applications such as web browsing, email, file transfer, and database access.
This topic is especially important for B.Tech CSE/IT students because it appears frequently in semester exams and interviews. Understanding the three way handshaking helps you explain how TCP achieves reliability and ordering, how it prevents old or duplicate connections, and how it deals with network delays and failures. You will also learn about TCP flags (SYN, ACK), sequence numbers, acknowledgment numbers, and the basic TCP state machine. By the end of this guide, you will be able to diagram the handshake, walk through an example with numbers, and discuss advantages, disadvantages, and security issues such as SYN flooding. The explanations use simple English, so you can memorize and recall the concepts easily during exams.
Definition of Three Way Handshaking
Three way handshaking is the TCP connection establishment process that uses three control messages (SYN, SYN-ACK, ACK) to synchronize sequence numbers and confirm that both the client and the server are ready to communicate reliably.
Quick Example (Simple Scenario)
Imagine a client wants to connect to a server:
- Step 1 (Client → Server): Client sends SYN with its initial sequence number (ISN), for example, 1000.
- Step 2 (Server → Client): Server replies with SYN-ACK. It sends its own ISN (say 5000) and acknowledges the client’s ISN by sending ACK = 1001.
- Step 3 (Client → Server): Client sends ACK with ACK = 5001 to acknowledge the server’s ISN.
After these three messages, the TCP connection is established and both sides can exchange data.
Why TCP Uses Three Way Handshaking
TCP uses three way handshaking to achieve the following goals:
- Agreement on initial sequence numbers (ISN) from both sides to ensure reliability and ordering.
- Confirmation that both client and server can receive and send (bidirectional readiness).
- Prevention of old duplicate connection requests (from an earlier session) from creating confusion.
- Establishing connection parameters (such as Maximum Segment Size and window scaling) during the SYN exchange.
Two-way handshaking (only SYN and ACK) is not enough because it cannot confirm the server’s sequence number and may allow half-open or duplicate connections. A three-step exchange confirms both directions, eliminating uncertainty before data starts to flow.
TCP Flags and Key Terms
- SYN (synchronize): Used to start a connection and announce an initial sequence number.
- ACK (acknowledge): Used to acknowledge received data or control messages.
- ISN (Initial Sequence Number): Starting sequence number chosen by each side to label bytes it will send.
- ACK Number: Next expected sequence number from the peer; acts as a positive acknowledgment.
- MSS (Maximum Segment Size): Option sent in SYN to indicate the largest segment size without fragmentation.
- Window Scale, SACK Permitted: Options exchanged in the handshake to improve performance on high-speed networks.
Step-by-Step: How Three Way Handshaking Works
Step 1: Client Sends SYN
The client is in the CLOSED state and actively opens a connection to the server’s IP and port (for example, a web server on port 80). It sends a TCP segment with the SYN flag set, chooses an initial sequence number (ISNc), and moves to the SYN-SENT state.
- Flags: SYN
- Seq = ISNc (e.g., 1000)
- No valid ACK number yet (since this is the first message)
- Options may include MSS, window scale, SACK-permitted, timestamps
Step 2: Server Sends SYN-ACK
When the server receives the SYN and is willing to accept connections on the specified port, it creates a half-open connection and moves to the SYN-RECEIVED state. It chooses its own initial sequence number (ISNs), replies with both SYN and ACK flags, acknowledges the client’s ISN, and shares its connection parameters.
- Flags: SYN, ACK
- Seq = ISNs (e.g., 5000)
- ACK = ISNc + 1 (e.g., 1001)
- Includes MSS and other options supported by the server
Step 3: Client Sends Final ACK
The client receives the SYN-ACK, acknowledges the server’s ISN, and transitions to the ESTABLISHED state. It sends a final ACK to the server.
- Flags: ACK
- Seq = ISNc + 1 (no data yet, so the sequence advances only if data is sent)
- ACK = ISNs + 1 (e.g., 5001)
When the server gets this ACK, it also transitions to the ESTABLISHED state. Now, both sides can send data segments with proper sequence and acknowledgment numbers.
Timing Diagram (Visualizing the TCP Handshake)
Below is a simple text diagram that shows message flow and sequence numbers. Time flows from top to bottom.
Client (C) Server (S)
C: SYN, Seq=1000, MSS=1460 ---------------------> S: listens on port
S enters SYN-RECEIVED
S: SYN, Seq=5000, ACK=1001, MSS=1460 <----------- C: receives, enters ESTABLISHED
C: ACK, Seq=1001, ACK=5001 ---------------------> S: receives, enters ESTABLISHED
Connection established (C ↔ S), data can now flow both ways.
TCP States During Three Way Handshaking
- Client:
- CLOSED → SYN-SENT (after sending SYN)
- SYN-SENT → ESTABLISHED (after receiving SYN-ACK and sending ACK)
- Server:
- LISTEN → SYN-RECEIVED (after receiving SYN)
- SYN-RECEIVED → ESTABLISHED (after receiving final ACK)
These states are part of the TCP finite state machine (FSM), which strictly controls how connections are created and closed.
Detailed Example with Numbers
Consider a client connecting to a server using the following numbers:
- Client ISNc = 72000
- Server ISNs = 901000
Exchange:
- Client → Server: SYN, Seq = 72000
- Server → Client: SYN-ACK, Seq = 901000, ACK = 72001
- Client → Server: ACK, Seq = 72001, ACK = 901001
After this, the next byte the client expects from the server starts at 901001, and the next byte the server expects from the client starts at 72001. Both sides are synchronized, which allows TCP to provide reliable, in-order delivery of data.
What Happens If Messages Are Lost?
TCP is robust against packet loss. If the client’s SYN or the server’s SYN-ACK is lost, the sender will retransmit after a timeout (RTO). If the final ACK is lost, the server stays in SYN-RECEIVED for a short time and will retransmit the SYN-ACK, prompting the client to send ACK again. These retransmissions ensure that temporary network issues do not permanently block connection setup.
Simultaneous Open (Advanced but Useful for Exams)
In rare cases, both endpoints actively open a connection to each other at the same time (simultaneous open). Both send SYNs and receive SYNs, then both reply with SYN-ACKs, and finally both send ACKs. Although unusual in client-server applications, this is part of the TCP specification and demonstrates that TCP handles bi-directional initiation correctly.
Parameters Negotiated During the Handshake
- MSS (Maximum Segment Size): Helps avoid IP fragmentation.
- Window Scale option: Extends TCP window size to support high bandwidth-delay product links.
- SACK Permitted (Selective Acknowledgment): Enables efficient recovery from packet loss.
- Timestamps: Improve RTT estimation and help with Protection Against Wrapped Sequence numbers (PAWS).
These features optimize performance and reliability and are commonly included in SYN and SYN-ACK segments.
Security Considerations: SYN Flood and SYN Cookies
Because the server allocates resources when it receives a SYN (creating a half-open connection), attackers can send many fake SYNs without completing the handshake. This is called a SYN flood attack and can exhaust server resources. To handle this, operating systems use techniques such as SYN cookies. With SYN cookies, the server does not allocate full state immediately; instead, it encodes information into the SYN-ACK sequence number and only creates state when the final ACK arrives. Firewalls, rate-limiting, and backlog tuning also help mitigate SYN floods.
Why Not Use Two-Way or Four-Way Handshakes?
- Two-way handshake (SYN then ACK) cannot confirm both directions and does not fully synchronize sequence numbers, risking duplicate or half-open connections.
- Four-way handshake would add unnecessary delay (one more RTT) without significant benefit for connection establishment.
The three-step sequence is the minimal, sufficient process to confirm both sides and synchronize numbers efficiently.
Advantages of Three Way Handshaking
- Reliability: Both sides confirm readiness and synchronize sequence numbers, reducing errors.
- Prevents duplicates: Helps avoid confusion from delayed or replayed connection requests.
- Bidirectional setup: Confirms that both client and server can send and receive.
- Parameter negotiation: MSS, window scaling, and SACK options are exchanged early.
- Compatibility: Well-supported across all operating systems and network devices.
- Security features integration: Works with SYN cookies and firewall policies to limit abuse.
Disadvantages / Limitations
- Extra latency: Requires at least one Round-Trip Time (RTT) before sending application data.
- Resource use on server: Half-open connections can consume memory during SYN floods.
- Overhead: Additional control packets compared to connectionless protocols like UDP.
- Not immune to spoofing: Attackers can spoof SYNs; mitigation is needed.
- Complexity: More state and logic than a simple two-way exchange or UDP.
- Mobile and lossy links: Retransmissions during handshake can add delay on unstable networks.
Real-World Notes for Students
- TCP Fast Open (TFO) allows sending limited data with SYN to reduce latency, but it still relies on handshake concepts and requires support on both ends.
- TLS/HTTPS handshake is different and happens over an established TCP connection; it does not replace the TCP three-way handshake.
- Modern stacks use SYN cache and SYN cookies to protect from floods and optimize performance.
- Wireshark can be used to observe SYN, SYN-ACK, and ACK packets; filter with “tcp.flags.syn == 1 or tcp.flags.ack == 1”.
Common Exam-Style Questions and Short Answers
- Q: What are the three messages in the TCP handshake? A: SYN, SYN-ACK, ACK.
- Q: Why not use a two-way handshake? A: It cannot confirm both directions and does not safely synchronize sequence numbers.
- Q: Which TCP states are involved? A: Client: CLOSED → SYN-SENT → ESTABLISHED; Server: LISTEN → SYN-RECEIVED → ESTABLISHED.
- Q: What is ISN? A: Initial Sequence Number, used to label bytes in a TCP stream and prevent confusion with old segments.
- Q: Name two options negotiated during the handshake. A: MSS and Window Scaling (also SACK Permitted, Timestamps).
Step-by-Step Recap (Memorize This Flow)
- Client sends SYN (Seq = ISNc) → enters SYN-SENT
- Server replies with SYN-ACK (Seq = ISNs, ACK = ISNc + 1) → server in SYN-RECEIVED
- Client sends ACK (ACK = ISNs + 1) → client in ESTABLISHED
- Server receives final ACK → server in ESTABLISHED
Conclusion / Summary
Three way handshaking is the foundation of TCP’s reliable connection establishment. Through three control messages—SYN, SYN-ACK, and ACK—the client and server synchronize their sequence numbers, confirm that both directions are open, and negotiate important parameters like MSS and window scaling. This process prevents duplicate or half-open connections and sets the stage for reliable, ordered data transfer. While the handshake introduces a small latency (one RTT) and can be targeted by SYN flood attacks, modern defenses such as SYN cookies and optimized backlogs reduce risk. For exams, remember the roles of SYN and ACK flags, the sequence and acknowledgment numbers, the involved states (SYN-SENT, SYN-RECEIVED, ESTABLISHED), and why a two-way handshake is insufficient. With these concepts clear, you can confidently explain how TCP builds trustworthy connections that power most applications on the internet.
Notes / Important Points for Exams
- Primary keyword: three way handshaking (also called TCP three-way handshake).
- Message order: SYN → SYN-ACK → ACK.
- States: Client (CLOSED → SYN-SENT → ESTABLISHED), Server (LISTEN → SYN-RECEIVED → ESTABLISHED).
- ISN and ACK numbers increment by 1 for SYNs because SYN consumes one sequence number.
- MSS, Window Scale, SACK Permitted are exchanged during SYN/SYN-ACK.
- Security: SYN flood attack and SYN cookies as mitigation.
- Handshake adds at least one RTT before data (latency consideration).
The connectionless alternative is UDP.