TCP three-way handshake

Type two numbers: the initial sequence number the client picks, then the server's. The sample, 100 and 300, is the example RFC 9293 uses, so the segments match its figures line for line. Show switches between the handshake, a whole connection (add a third number to send that many bytes in the middle), and the close on its own.

The animation below plays one segment at a time, with each side's state after it arrives. Segments are written the way the RFC writes them: <SEQ=101><ACK=301><CTL=ACK>.

SYN: the client sends a segment with the SYN flag set and its initial sequence number, say 100. It moves to SYN-SENT.

SYN-ACK: the server replies with SYN and ACK both set. Its own sequence number is its initial number, 300, and its acknowledgement number is 101. An ACK number always means "the next number I expect", and the SYN used up 100, so the next is 101.

ACK: the client acknowledges the server's SYN with ACK 301, its own sequence number now 101. Both sides are ESTABLISHED and data can flow. Each side has told the other its starting number, and each has heard the other confirm it.

RFC 9293 gives the main reason: to stop old duplicate connection requests from causing confusion. A SYN delayed in the network from a connection long gone could arrive at a server. With only two steps the server would open a connection nobody wanted. With three, the server's SYN-ACK goes to the client, which sees it acknowledges a SYN it didn't just send, and refuses it.

It's also the fewest messages that let both sides check the other received their starting number: each SYN needs its own acknowledgement, and the server's SYN and ACK travel together.

Every byte TCP sends has a number, and the sequence number on a segment is the number of its first byte. SYN and FIN count as one each, though they carry no data, which is why acknowledging a SYN adds 1. Send 50 bytes starting at 101 and they're numbered 101 to 150; the receiver answers ACK 151.

The starting numbers aren't 0 or 1. RFC 9293 requires them to come from a clock-driven generator mixed with a secret hash of the connection's addresses and ports, so someone outside can't guess them and inject segments. Wireshark shows "relative" numbers starting at 0 to make captures readable; the real ones are large and look random. The numbers are 32 bits, so they wrap round to 0 after 4,294,967,295.

Each direction closes on its own. The side that's finished sends FIN; the other acknowledges it, but may still have data to send, so its own FIN can come later. That makes four segments, though the middle two are often sent together.

The side that closed first then waits in TIME-WAIT for twice the maximum segment lifetime, 2 MSL. RFC 9293 sets MSL at 2 minutes as an engineering choice. The wait means a lost final ACK can be resent when the other side repeats its FIN, and stray segments from this connection die out before a new one reuses the same addresses and ports.