Understanding TCP: Why Three-Way Handshake and Four-Way Teardown Matter

TCP is a core protocol for reliable data transmission; this article summarizes its connection establishment and termination processes.

First, the three-way handshake:

1. The client initiates the connection by sending a SYN=1, ACK=0 packet with an initial sequence number seq=x.

SYN creates a synchronization number; when SYN=1 and ACK=0, it signals a connection request. The SYN packet cannot carry data but consumes a sequence number.

ACK is meaningful only when ACK=1, confirming the expected next byte. After the handshake, all packets have ACK=1.

The client’s state becomes SYN‑SEND.

2. The server receives the SYN packet and replies with SYN=1, ACK=1, acknowledging seq=x+1 and choosing its own initial sequence number seq=y.

The server’s state becomes SYN‑RECEIVED.

3. The client receives the server’s response and sends a final ACK=1 with ack=y+1.

The client’s state transitions to ESTABLISHED, completing the three-way handshake.

The article also explains why a two‑step handshake is insufficient, illustrating scenarios where lost or duplicate packets could cause resource waste or erroneous connections.

Then, the four-way termination:

Both sides are in ESTABLISHED state.

1. The client initiates termination by sending FIN=1, seq=u (u is the last byte sent plus one). The client enters FIN‑WAIT‑1, awaiting the server’s acknowledgment.

2. The server acknowledges with ACK=1, seq=v, ack=u+1, entering CLOSE‑WAIT.

3. When the server has no more data to send, it sends FIN=1, ACK=1, ack=u+1, seq=w, entering LAST‑ACK.

4. The client acknowledges with ACK=1, seq=u+1, ack=w+1, then waits for two time‑wait intervals before fully closing.

The waiting period ensures that any lost ACKs are retransmitted and that delayed packets from the previous connection do not interfere with future connections.