1.1 TCP Three-Way Handshake

This is a historical learning note and may contain outdated or incomplete understanding.

1. What Is the Three-Way Handshake?

The so-called Three-way Handshake means that when establishing a TCP connection, the client and server need to send a total of three packets.

The purpose of the three-way handshake is to connect to the specified server port, establish a TCP connection, synchronize the sequence numbers and acknowledgement numbers of both sides, and exchange TCP window-size information.

2. Three-Way Handshake Process

TCP Three-Way Handshake

At the beginning, both the client and the server are in the CLOSED state, and the server starts LISTEN.

Memory aid: set SYN/ACK to 1. SYN comes with a SEQ Number, and ACK comes with an ACK Number. After sending, consider which state is entered.

First handshake

The client sends a segment.

Set SYN to 1 and SEQ Number to X.

After sending, the client enters the SYN_SEND state.

Second handshake

The server replies with a segment.

Set ACK to 1 and ACK Number to x+1; set SYN to 1 and SEQ Number to y.

After sending, the server enters the SYN_RCVD state.

Third handshake

The client replies with a segment.

Set ACK to 1 and ACK Number to y+1.

After sending, the client enters the ESTABLISHED state.

When the server receives this packet, it also enters the ESTABLISHED state.

2.1. Example

A randomly generates a 32-bit Initial Sequence Number (for example, 1000), then sends it to B.
After B receives A’s ISN, it saves it locally. At the same time, it generates an Initial Sequence Number (for example, 2000). Then it sends A’s ISN ACK (1001) + B’s ISN together.
After A receives B’s ISN and ACK, it confirms that its own data starting point is 1001. It needs to send B’s ISN ACK (2001) to B.

After B receives the ACK, it confirms that its own data starting point is 2001.

3. Why Are Three Handshakes Needed?

The three-way handshake exchanges the initial sequence numbers for communication in both directions. Each side’s initial sequence number needs at least one round trip.

Four handshakes would split step 2 into two steps, which is unnecessary, so they are combined into three.
With two handshakes, the starting point for B’s communication cannot be determined.

4. Problems

4.1. SYN Flood

If the server does not receive the client’s ACK after the second handshake, the server keeps retransmitting SYN-ACK packets until timeout. Linux defaults to a timeout of 63 seconds.

SYN Attack.md