Mastering TCP: How the Three‑Way Handshake and Four‑Way Teardown Work

TCP Three‑Way Handshake

The TCP header contains three important flags: ACK (acknowledgment), SYN (synchronize), and FIN (finish). The handshake establishes a reliable connection in three steps:

Client sends a SYN packet with a randomly generated sequence number x (SYN=1, seq=x) to request a connection.

Server replies with its own SYN and an ACK that acknowledges the client’s sequence (ACK=x+1). The server’s packet includes a new random sequence number y (SYN=1, ACK=x+1, seq=y).

Client acknowledges the server’s sequence by sending an ACK with y+1 (ACK=y+1, seq=x+1). After this exchange both sides are in the ESTABLISHED state.

TCP Four‑Way Termination

Closing a TCP connection requires four messages to ensure all data is transmitted before the link is torn down:

Client sends a FIN packet with a random sequence number x (FIN=1, seq=x) to request termination.

Server acknowledges the request with an ACK (ACK=x+1) and its own sequence number y (FIN=1, ACK=x+1, seq=y).

After confirming that all pending data has been sent, the server sends its own FIN (FIN=1, seq=z) and an ACK for the client’s FIN (ACK=x+1).

Client acknowledges the server’s FIN with an ACK (ACK=z+1, seq=h), entering TIME_WAIT before finally moving to CLOSED .

TCP Connection States (11)

The TCP state machine defines eleven possible states for a socket during its lifecycle:

LISTEN : waiting for incoming connection requests.

SYN_SENT : client has sent a SYN and awaits a matching response.

SYN_RECEIVED : server has received a SYN and sent SYN‑ACK, awaiting final ACK.

ESTABLISHED : connection is open and data can be exchanged.

FIN_WAIT_1 : client has sent FIN and awaits ACK or a simultaneous FIN.

FIN_WAIT_2 : client has received ACK for its FIN and waits for server’s FIN.

CLOSE_WAIT : server has received FIN and acknowledges it, waiting for the application to close.

CLOSING : both sides have sent FIN but the ACK for the remote FIN is still pending (occurs when an ACK is lost).

LAST_ACK : server has sent FIN and awaits the final ACK from the client.

TIME_WAIT : client waits long enough (2 MSL) to ensure the remote side received its ACK.

CLOSED : no connection state; the socket is ready to be reused.

The CLOSING state specifically occurs when a FIN is sent, the ACK is lost, and the opposite side’s FIN arrives before the missing ACK is retransmitted.

Original source: https://blog.51cto.com/jinlong/2065461