What is the TCP Three-Way Handshake?
Learn the TCP three-way handshake — SYN, SYN-ACK, ACK — how connections are established and why it matters, with interview Q&A.
Expected Interview Answer
The TCP three-way handshake is the process a client and server use to establish a reliable connection before exchanging data: the client sends a SYN, the server replies with SYN-ACK, and the client confirms with an ACK — after which both sides agree on initial sequence numbers and the connection is open.
First, the client sends a SYN (synchronize) segment carrying its initial sequence number, signalling a request to open a connection. The server responds with a SYN-ACK segment that acknowledges the client’s sequence number and includes its own initial sequence number. Finally, the client sends an ACK segment acknowledging the server’s sequence number, and the connection enters the ESTABLISHED state on both sides. This exchange lets both peers agree on starting sequence numbers used for reliable, ordered delivery, and confirms that both directions of the path are working before any application data flows. Closing a TCP connection uses a separate four-step FIN-based teardown, not the same handshake.
- Confirms both directions of the path work before data flows
- Synchronizes initial sequence numbers for reliable ordering
- Prevents stale or duplicate connection requests from being accepted
- Establishes state so both sides know the connection is open
AI Mentor Explanation
The three-way handshake is like an umpire confirming readiness before the first ball: the bowler signals “ready to start” (SYN), the umpire calls back “confirmed, and are you ready too?” (SYN-ACK), and the bowler replies “yes, starting now” (ACK) — only after all three signals does play officially begin. Skipping any signal means the over cannot start cleanly. This three-step confirmation is exactly why TCP waits for all three messages before sending real data.
Step-by-Step Explanation
Step 1
SYN
Client sends a SYN segment with its initial sequence number to request a connection.
Step 2
SYN-ACK
Server acknowledges the client’s SYN and replies with its own SYN carrying its sequence number.
Step 3
ACK
Client acknowledges the server’s SYN; the connection is now ESTABLISHED on both sides.
Step 4
Data transfer
Only after all three steps does application data begin flowing over the connection.
What Interviewer Expects
- Correctly names SYN, SYN-ACK, ACK in order
- Explains that sequence numbers are exchanged/synchronized
- Understands the connection is ESTABLISHED only after step 3
- Knows this differs from the FIN-based four-step teardown
Common Mistakes
- Calling it a "two-way" handshake or skipping the final ACK
- Confusing the handshake with the connection teardown process
- Thinking data is sent during the handshake itself
- Forgetting that both sides pick their own initial sequence number
Best Answer (HR Friendly)
“The TCP three-way handshake is how two computers say hello before talking: one says "I want to connect," the other says "okay, and are you ready?", and the first confirms "yes, let us go." Only after that quick three-step exchange does real data start flowing, which is what makes TCP connections reliable from the very first byte.”
Code Example
# Capture the SYN, SYN-ACK, ACK sequence when connecting to a host
sudo tcpdump -n 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' -i any host example.com
# Typical output:
# 10.0.0.5 > 93.184.216.34: Flags [S], seq 1000 (SYN)
# 93.184.216.34 > 10.0.0.5: Flags [S.], seq 5000, ack 1001 (SYN-ACK)
# 10.0.0.5 > 93.184.216.34: Flags [.], ack 5001 (ACK)Follow-up Questions
- How does TCP close a connection (four-way termination)?
- What is a SYN flood attack and how is it mitigated?
- How do sequence and acknowledgement numbers increment after the handshake?
- What happens if the final ACK is lost?
MCQ Practice
1. What is the correct order of the TCP three-way handshake?
The handshake proceeds SYN from client, then SYN-ACK from server, then ACK from client.
2. What state is the connection in after the handshake completes?
Once the final ACK is received, both sides mark the connection as ESTABLISHED.
3. What does the handshake primarily synchronize between hosts?
Each side exchanges and acknowledges its own initial sequence number during the handshake.
Flash Cards
Three steps of the handshake? — SYN (client) → SYN-ACK (server) → ACK (client).
What does the handshake establish? — A reliable connection with synchronized initial sequence numbers.
When can data be sent? — Only after the final ACK, once the connection is ESTABLISHED.
How does TCP close a connection? — Via a separate four-step FIN/ACK exchange, not the same handshake.