Why TCP Needs a Three‑Way Handshake and a Four‑Way Termination
This article explains how TCP establishes reliable connections with a three‑way handshake, why three steps are necessary, and how it gracefully closes connections using a four‑way termination, detailing each packet flag and state transition.
1 Three‑Way Handshake
Initially both client and server are in CLOSED state and create their own Transmission Control Blocks (TCB). The server moves to LISTEN state, ready to receive connection requests.
First handshake : The client sends a SYN segment (SYN=1, ACK=0, seq=x) and enters SYN‑SENT state. SYN=1, ACK=0 indicates a connection request; x is the initial sequence number, and the SYN consumes one sequence number.
SYN=1, ACK=0 means the segment is a connection request.
x is the initial sequence number; a SYN segment carries no data but uses one sequence number.
Second handshake : The server replies with SYN=1, ACK=1, seq=y, ack=x+1 and enters SYN‑RCVD state. SYN=1, ACK=1 indicates a connection‑acceptance response; y is the server’s initial sequence number; ack=x+1 tells the client the next expected byte.
SYN=1, ACK=1 marks the segment as a connection‑acceptance response.
seq=y is the server’s initial sequence number.
ack=x+1 indicates the server expects the next byte to be x+1.
Third handshake : The client acknowledges the server’s response with ACK=1, seq=x+1, ack=y+1, then both sides enter ESTABLISHED state, completing the connection.
2 Why Three Handshakes Are Needed
Three handshakes prevent a stale connection request from being mistakenly accepted. If only two handshakes were used, a lost request could be retransmitted after the client has timed out and closed, causing the server to remain in ESTABLISHED state while the client is CLOSED, wasting resources.
3 Four‑Way Termination
TCP connection termination requires four steps because the connection is bidirectional; the first two steps close one direction, the last two close the opposite direction.
First termination : A (the initiator) sends FIN=1, seq=u and enters FIN‑WAIT‑1.
FIN=1 marks a connection‑release request.
seq=u (u‑1 is the last byte sent by A).
Second termination : B acknowledges with ACK=1, seq=v, ack=u+1 and enters CLOSE‑WAIT.
ACK=1 indicates an acknowledgment.
seq=v (v‑1 is B’s last byte).
ack=u+1 means B expects the next byte from A to be u+1.
A now waits in FIN‑WAIT‑2 for B’s termination request.
Third termination : After B finishes sending data, it sends FIN=1, ACK=1, seq=w, ack=u+1 and enters LAST‑ACK.
Fourth termination : A acknowledges with ACK=1, enters TIME‑WAIT for 2 MSL to ensure B receives the ACK; after this period A moves to CLOSED, and B also transitions to CLOSED upon receiving the ACK.
4 Why A Enters TIME‑WAIT
A stays in TIME‑WAIT to guarantee B receives the final ACK. If A closed immediately and the ACK was lost, B would retransmit its FIN, but A would no longer respond, preventing a clean shutdown.
Signed-in readers can open the original source through BestHub's protected redirect.
This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactand we will review it promptly.
MaGe Linux Operations
Founded in 2009, MaGe Education is a top Chinese high‑end IT training brand. Its graduates earn 12K+ RMB salaries, and the school has trained tens of thousands of students. It offers high‑pay courses in Linux cloud operations, Python full‑stack, automation, data analysis, AI, and Go high‑concurrency architecture. Thanks to quality courses and a solid reputation, it has talent partnerships with numerous internet firms.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.
