TCP three-way handshake and why it needs three steps

Both sides need to pick a starting sequence number and know the other side received it.

Model answer. TCP is connection-oriented: before sending data, both ends agree to communicate and synchronise their initial sequence numbers (ISNs).

The handshake

1. SYN — client → server: SYN flag set, sequence number = x (client's ISN).
2. SYN-ACK — server → client: SYN and ACK flags set, sequence number = y (server's ISN), acknowledgement number = x + 1.
3. ACK — client → server: ACK flag set, sequence number = x + 1, acknowledgement number = y + 1.

The connection is now ESTABLISHED on both sides. The SYN consumes one sequence number, which is why the ACK is x + 1 rather than x. Options such as maximum segment size (MSS), window scaling and SACK support are negotiated in the SYN and SYN-ACK. ISNs are chosen unpredictably for security, which makes it hard for an attacker to spoof segments that fit into an existing connection.

Why not two steps?

• Each direction has its own sequence-number stream. The server must know that the client received the server's ISN; only the third message confirms that.
• It protects against old duplicate SYNs: a delayed SYN from a previous connection could arrive at the server. With only two steps, the server would treat it as a new connection and allocate resources. With three steps, the client sees an unexpected SYN-ACK and responds with RST instead of ACK.

Closing a connection

• Each side closes its direction separately: FIN → ACK from one side, then FIN → ACK from the other (four segments, though the middle two are often combined).
• The side that closes first enters TIME_WAIT for 2 × MSL (maximum segment lifetime) so that a lost final ACK can be retransmitted and old segments die out before the same port pair is reused.

Common follow-up: "What is a SYN flood?" An attacker sends many SYNs without completing the handshake, filling the server's half-open connection queue. SYN cookies let the server encode the connection state in its ISN and avoid storing anything until the final ACK arrives.