Why TCP Needs Three Handshakes and Four Teardowns: A Deep Dive

TCP Header Format

TCP header fields include:

Source and Destination Ports – identify the application endpoints.

Sequence Number – numbers each byte to detect out‑of‑order delivery.

Acknowledgment Number – confirms receipt of data; missing ACK triggers retransmission.

Control Flags – SYN (initiate connection), ACK (acknowledge data), RST (reset), FIN (terminate).

Window Size – flow‑control value indicating how much data the receiver can accept.

Three‑Way Handshake

The connection is established in three steps to guarantee that both sides have synchronized state even in the presence of packet loss, duplication, or delay.

Client sends SYN with an initial sequence number (ISN).

Server replies with SYN‑ACK , acknowledging the client’s ISN and providing its own ISN.

Client sends ACK acknowledging the server’s ISN. At this point both sides enter the ESTABLISHED state.

Each side chooses a random 32‑bit ISN that increments roughly every 4 ms, reducing the chance of sequence‑number collisions after a reconnect.

Handshake State Diagram

Client and server start in CLOSED state.

Server moves to LISTEN .

Client sends SYN → SYN‑SENT .

Server replies SYN‑ACK → SYN‑RCVD .

Client sends final ACK → ESTABLISHED on both sides.

Four‑Way Termination

Connection teardown uses four steps so that each endpoint can finish sending pending data before the socket is fully closed.

Termination State Diagram

Client sends FIN → FIN_WAIT_1 .

Server receives FIN, sends ACK → CLOSE_WAIT .

Client receives ACK, moves to FIN_WAIT_2 .

Server sends its own FIN; client ACKs and enters TIME_WAIT .

The Maximum Segment Lifetime (MSL) defines how long a closed port is kept in TIME_WAIT (commonly 2 minutes) to ensure delayed packets are discarded before the port can be reused.

TCP State Machine

The complete TCP state machine combines the establishment and termination sequences. Key states are:

CLOSED

LISTEN

SYN‑SENT

SYN‑RCVD

ESTABLISHED

FIN‑WAIT‑1

FIN‑WAIT‑2

CLOSE‑WAIT

CLOSING

LAST‑ACK

TIME‑WAIT

Listening on a Port

On the server side, a socket is placed into the LISTEN state by calling the system listen() function on a bound socket. While in LISTEN, the kernel accepts incoming SYN packets and initiates the three‑way handshake.