Fundamentals 13 min read

What Happens When TCP Handshake or Teardown Packets Are Lost?

This article explains how TCP connections behave when any of the three-way handshake or four-way termination packets are lost, detailing the kernel‑controlled retransmission mechanisms, timeout intervals, relevant sysctl parameters, and the exact sequence of events for each loss scenario.

Liangxu Linux
Liangxu Linux
Liangxu Linux
What Happens When TCP Handshake or Teardown Packets Are Lost?

TCP Three‑Way Handshake Packet Loss

First handshake (SYN) loss

When a client initiates a TCP connection it sends a SYN packet and enters the SYN_SENT state. If the SYN is lost, the client starts a timeout‑retransmission timer. The SYN is retransmitted with the same sequence number. Retransmission intervals double (1 s, 2 s, 4 s, 8 s, 16 s, 32 s) and the total wait time is about 63 seconds.

# cat /proc/sys/net/ipv4/tcp_syn_retries
5

The maximum number of SYN retransmissions is controlled by the tcp_syn_retries kernel parameter (default 5). After the final timeout the client aborts the connection.

If tcp_syn_retries is set to 3, the client will retransmit the SYN three times (1 s, 2 s, 4 s) and then wait an additional 8 s before giving up.

Second handshake (SYN‑ACK) loss

After the server receives the SYN it replies with a SYN‑ACK and moves to SYN_RCVD. If this SYN‑ACK is lost, the client assumes its SYN was not acknowledged and retransmits the SYN according to tcp_syn_retries. Simultaneously the server retransmits the SYN‑ACK according to tcp_synack_retries (default 5).

# cat /proc/sys/net/ipv4/tcp_synack_retries
5

Client retransmits SYN up to tcp_syn_retries times.

Server retransmits SYN‑ACK up to tcp_synack_retries times.

Third handshake (ACK) loss

When the client receives the SYN‑ACK it sends an ACK and enters ESTABLISHED. The ACK itself is not retransmitted; instead the server will retransmit its SYN‑ACK if the ACK is not received, using the same tcp_synack_retries limit.

If tcp_synack_retries is 2, the server will resend the SYN‑ACK twice before aborting.

TCP Four‑Way Termination Packet Loss

First FIN loss (client initiates close)

The client sends a FIN and enters FIN_WAIT_1. If the FIN is lost, the client retransmits it according to tcp_orphan_retries (default 0, often set to a small value). After exceeding the limit the client stops sending FIN and eventually closes the socket.

Second FIN/ACK loss (server acknowledges first FIN)

The server replies with an ACK and moves to CLOSE_WAIT. If this ACK is lost, the client will retransmit its FIN (again governed by tcp_orphan_retries) until the server finally receives it.

Third FIN loss (server initiates its own FIN)

After the server calls close it sends a FIN and enters LAST_ACK. If this FIN is lost, the server retransmits it according to tcp_orphan_retries. The client, after receiving the server’s FIN, sends an ACK and enters TIME_WAIT. If the client does not receive the server’s FIN, it will keep waiting up to tcp_fin_timeout (default 60 s) before aborting.

Fourth ACK loss (client acknowledges server’s FIN)

The client’s ACK to the server’s FIN puts the client into TIME_WAIT. If this ACK is lost, the server will retransmit its FIN (still limited by tcp_orphan_retries) until the client finally acknowledges or the retry limit is reached.

Both sides use tcp_orphan_retries to limit FIN retransmissions.

The client’s TIME_WAIT state lasts for 2 MSL (maximum segment lifetime) before the socket is fully closed.

Original Source

Signed-in readers can open the original source through BestHub's protected redirect.

Sign in to view source
Republication Notice

This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactadmin@besthub.devand we will review it promptly.

networkTCPlinuxThree-way handshakeFour-way terminationPacket Loss
Liangxu Linux
Written by

Liangxu Linux

Liangxu, a self‑taught IT professional now working as a Linux development engineer at a Fortune 500 multinational, shares extensive Linux knowledge—fundamentals, applications, tools, plus Git, databases, Raspberry Pi, etc. (Reply “Linux” to receive essential resources.)

0 followers
Reader feedback

How this landed with the community

Sign in to like

Rate this article

Was this worth your time?

Sign in to rate
Discussion

0 Comments

Thoughtful readers leave field notes, pushback, and hard-won operational detail here.