Fundamentals 10 min read

Why Does TCP Need a Three‑Way Handshake and a Four‑Way Teardown?

This article explains why TCP requires a three‑way handshake to establish connections and a four‑step termination process, using a relatable video‑call scenario and detailed protocol diagrams to illustrate the underlying mechanisms and practical rules for confirming audio transmission.

MaGe Linux Operations
MaGe Linux Operations
MaGe Linux Operations
Why Does TCP Need a Three‑Way Handshake and a Four‑Way Teardown?

Background

In a long‑distance video call, the two participants often experience network glitches that cause the audio to drop, leading to repeated questions like "Can you hear me?".

Problem

When the connection is unstable, each side must constantly verify whether the other can hear them, which becomes tedious.

Solution

The situation can be modeled after TCP's three‑way handshake. Both parties agree on a simple protocol:

Either side can initiate a check when the network seems bad.

If no response is received within 5 seconds, the network is considered down.

After a 1‑minute router reset, the check can be retried.

When one side sends a question like "1+1 equals?", the other replies with the answer and a new question. If the reply arrives within 5 seconds, both confirm that they can hear each other and continue the conversation.

Four‑Way Handshake (Connection Termination)

To close a TCP connection, four packets are exchanged:

Client sends FIN to stop its data flow.

Server acknowledges with ACK.

Server sends its own FIN.

Client acknowledges with ACK and enters TIME_WAIT.

This ensures that all pending data is transmitted before the socket is fully closed.

TCP Packet Format

Key fields in a TCP segment include:

Seq: 32‑bit sequence number.

Ack: 32‑bit acknowledgment number (valid when ACK flag is set, Ack = Seq+1).

Flags: URG, ACK, PSH, RST, SYN, FIN.

Note the difference between the Ack field and the ACK flag.

Three‑Way Handshake (Connection Establishment)

The steps are:

Client sends SYN with an initial sequence number J.

Server replies with SYN‑ACK, acknowledging J+1 and providing its own sequence number K.

Client sends ACK acknowledging K+1, completing the connection.

Only after this exchange can data be transmitted.

# netstat -nap | grep SYN_RECV

Additional Notes

Typical interview questions include describing the three‑way handshake, the four‑way termination, and why connection establishment uses three packets while termination requires four.

Original Source

Signed-in readers can open the original source through BestHub's protected redirect.

Sign in to view source
Republication Notice

This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactadmin@besthub.devand we will review it promptly.

TCPReliabilityFour-way HandshakeThree-way handshakenetwork protocol
MaGe Linux Operations
Written by

MaGe Linux Operations

Founded in 2009, MaGe Education is a top Chinese high‑end IT training brand. Its graduates earn 12K+ RMB salaries, and the school has trained tens of thousands of students. It offers high‑pay courses in Linux cloud operations, Python full‑stack, automation, data analysis, AI, and Go high‑concurrency architecture. Thanks to quality courses and a solid reputation, it has talent partnerships with numerous internet firms.

0 followers
Reader feedback

How this landed with the community

Sign in to like

Rate this article

Was this worth your time?

Sign in to rate
Discussion

0 Comments

Thoughtful readers leave field notes, pushback, and hard-won operational detail here.