The TCP Three-Way Handshake: How the SYN, SYN-ACK, and ACK Sequence Establishes Reliable Network Connections

Every time a web browser loads a single webpage, the underlying computers exchange exactly three invisible messages—a sequence of just a few dozen bytes—before a single pixel of content is ever sent. This mechanism, known as the TCP three-way handshake, is the foundational agreement that makes the modern internet reliable.[4]

For network engineers and system administrators, mastering this sequence is the first step in diagnosing network failures. When a server goes offline or a firewall blocks traffic, packet capture tools will show exactly where the handshake failed. If the three steps do not complete, no data transfer can occur.[2][3]

The process begins when a client device attempts to communicate with a server. The client sends a single packet with the Synchronize (SYN) control flag set to 1. This initial message acts as a formal request, informing the server that the client wishes to open a communication channel.[2][4]

Crucially, this SYN packet contains a randomly generated 32-bit sequence number. Because a 32-bit field can hold over 4.2 billion unique values, starting with a random number prevents older, delayed packets from previous network sessions from being mistakenly accepted as current data.[1]

Upon receiving the SYN packet, the server must acknowledge the request. It replies with a packet that has two flags set: SYN and ACK (Acknowledgment). This SYN-ACK packet serves a dual purpose: it confirms receipt of the client's sequence number and provides the server's own randomly generated sequence number.[2][4]

The acknowledgment number sent by the server is not arbitrary. It is exactly the client's initial sequence number plus 1. This mathematical increment is how the Transmission Control Protocol (TCP) tracks data and guarantees that no packets are lost in transit.[2]

Finally, the client receives the SYN-ACK packet and must confirm it. The client sends a third packet back to the server, this time with only the ACK flag set to 1. The acknowledgment number in this final packet is the server's sequence number plus 1.[2][4]

Once the client sends that final ACK, the connection is fully established. The operating systems on both ends transition the socket state to an established mode, and bidirectional data transfer can begin immediately. The entire exchange typically takes just a few milliseconds, depending on the physical distance between the client and the server.[1]

The rules governing this exchange are strictly defined by the Internet Engineering Task Force (IETF). While the original specification was published in 1981 as RFC 793, the standard was comprehensively updated in 2022 with the publication of RFC 9293, which consolidated decades of errata and improvements into a single document.[1]

Because the handshake requires the server to allocate memory for the pending connection after sending the SYN-ACK, it introduces a structural vulnerability. "SYN flood attacks work by exploiting the handshake process of a TCP connection," explains Cloudflare's technical documentation on denial-of-service vulnerabilities. "Under normal conditions, TCP connection exhibits three distinct processes in order to make a connection." Malicious actors send thousands of SYN packets per second from spoofed IP addresses, deliberately ignoring the server's replies.[3][5]

The server leaves the ports open, waiting for the final ACK packets that never arrive. Eventually, the server's backlog fills up, and it drops legitimate traffic. Modern mitigation strategies involve handling the handshake in a distributed cloud network, absorbing the resource cost of bogus SYN packets before they reach the targeted origin server.[5]

Just as a connection requires three steps to open, it requires a formal process to close. The standard graceful termination uses a four-step exchange involving the FIN (Finish) flag. The client sends a FIN, the server sends an ACK, the server sends its own FIN, and the client sends a final ACK.[1]

Network monitoring tools routinely track these handshake metrics to identify malicious behavior. For example, connections that terminate within the first 10 ingress packets are often classified as anomalous, using incomplete handshakes to detect port scanning or connection tampering.[3]

The three-way handshake remains the invisible scaffolding of digital communication. Whether streaming a 4K video or sending a plain text email, the reliability of the exchange depends entirely on those first three synchronized messages successfully crossing the network.[6]