Understanding TCP Handshake, Termination, and State Machine Explained

Three‑Way Handshake

The handshake uses three packets marked by the SYN, ACK, and FIN flags in the TCP header. The client initiates a connection by sending a SYN packet with a random sequence number (SYN=1, seq=x). The server replies with its own SYN and an ACK that acknowledges the client’s sequence (SYN=1, ACK=x+1, seq=y). Finally, the client acknowledges the server’s sequence (SYN=1, ACK=y+1, seq=x+1), completing the connection establishment.

Four‑Way Termination

The termination also occurs in four steps. The client sends a FIN packet with a random sequence number (FIN=1, seq=x). The server acknowledges this with ACK (FIN=1, ACK=x+1, seq=y). After ensuring all data is sent, the server sends its own FIN (FIN=1, ACK=x+1, seq=z). The client replies with an ACK (FIN=1, ACK=z+1, seq=h), completing the shutdown.

TCP Connection States (11)

TCP connections transition through eleven possible states:

LISTEN : waiting for a connection request from any remote TCP and port.

SYN_SENT : after sending a connection request, waiting for a matching response.

SYN_RECEIVED : after receiving a matching request, waiting for connection confirmation.

ESTABLISHED : normal data transfer state.

FIN_WAIT_1 : waiting for remote termination request or acknowledgment of its own FIN.

FIN_WAIT_2 : waiting for remote termination request.

CLOSE_WAIT : waiting for the local user to close.

CLOSING : waiting for acknowledgment of its own FIN while remote FIN has been received.

LAST_ACK : waiting for acknowledgment of the previously sent FIN.

TIME_WAIT : ensuring the remote TCP received the termination acknowledgment and allowing old duplicate segments to expire.

CLOSED : no longer part of any connection.

The CLOSING state occurs when the client’s FIN is sent but its ACK is lost, and the server’s FIN arrives first.