TCP 3-way handshake

We assume that both client and server side start from CLOSED status.

Three way handshake

1. The server process create a TCB [1] and use TCB prepares to accept the clients request. After TCB born the server change status to LISTEN.

2. The host does the same thing, create a TCB and use this TCB to send request, set the "SYN=1" in the request header, and initiates a arbitrary sequence number, seq=x. SYN packet (which means SYN=1) can not take any data content, but it will consume a sequence number. After request sent, the client goes into SYN-SENT status.

3. After receiving the clients request:

4. After the client received the server's response, it will send back also a confirm packet with ACK bit sets to '1' and seq=x+1, ack=y+1. [2]

After that, both side goes into ESTABLISHED status. This is what we called three-way handshake.


3-way handshake.png

Capture Example

3-way handshake.pcap

[1]. TCB---Transmission Control Block, something like PCB, it stores some significant info like, TCP connection table, the pointer for the sending and receiving buffer, retransmission queue pointer, the current sequence number and acknowledge number and ext.

[2]. ACK packet could take data content, if not, this packet will not consume SYN number. So the sequence number of the confirm packet is seq=x+1. But in practice, at times, TCP 3-way handshake not only just initiates the connection, but also negotiate some very important parameters. MSS (maximum segment size) negotiation occurs in this steps.

Imported from on 2020-08-11 23:26:28 UTC