September 19, 2026
TCP Three way Handshake
For my first Medium post, I wanted to write about the TCP three-way handshake. This is a brief breakdown of the topic.
By Nahid
1 min read
The TCP handshake is a three-step process used by the Transmission Control Protocol (TCP) to create a reliable connection between two computers before any data is exchanged.
Step 1: SYN The client initiates the connection by sending a SYN packet with its initial sequence number (ISN). This tells the server that the client is trying to start communication.
Step 2: SYN-ACK The server responds to the client's request with a packet that has both the SYN and ACK flags set. It sends its own initial sequence number and acknowledges the client's sequence number by replying with the client's ISN + 1.
Step 3: ACK In the final step, the client acknowledges the server's sequence number (the server's ISN + 1). Both sides now have a reliable connection, and they can start transferring data.
How synchronization happens in the three-way handshake
- Each side shares its initial sequence number.
- Each side confirms the other's sequence number using an acknowledgment.
- After both acknowledgments are verified, the connection enters the ESTABLISHED state.
Why this matters
Understanding the three-way handshake is important in cybersecurity because attackers can abuse it. In a SYN flood attack, an attacker sends a large number of SYN requests but never sends the final ACK. The server keeps waiting on these half-open connections, which uses up its resources until it can't respond to legitimate users. Defenses like SYN cookies help servers handle this without running out of resources.