Card 02/ 11
The Three-Way Handshake: SYN, SYN-ACK, ACK
Before any data, each side picks a starting number and confirms the other's.
The three-way handshake opens a TCP connection: the client sends a SYN, the server replies with a SYN-ACK, and the client answers with an ACK, after which either side may send data. Its purpose is for each side to choose its initial sequence number and to see the other side acknowledge it, so both know the numbering is agreed.
SYN (synchronise) and ACK (acknowledge) are flags in the TCP header. The values below are illustrative; real starting numbers are random.
Opening the connection, segment by segment
The client sends a SYN
The client picks its initial sequence number, here 1000, and sends a segment with the SYN flag set and no data. It is asking to open a connection, and announcing where its numbering starts.
The server replies with a SYN-ACK
The server picks its own initial sequence number, 5000, and sets both flags. Its acknowledgement number is 1001: a SYN counts as one byte of sequence space even though it carries no data, so the next byte the server expects is 1001.
The client sends an ACK
The client acknowledges the server's SYN with 5001, by the same rule. Both starting numbers are now confirmed, and the connection is open.
Data flows
The client's first byte of data is numbered 1001. On most systems this request goes out right after the ACK, often in the same segment.
The rule that a SYN uses one sequence number is what lets it be acknowledged at all. Without it, an acknowledgement of the SYN would look the same as acknowledging nothing. A FIN, which closes a connection, counts as one byte for the same reason. Data bytes, by contrast, count exactly: 500 bytes of data move the number forward by 500, not 501.
The handshake costs one full round trip before the client can send its request, which is why the time to reach a server matters even for a tiny request: on a 100 ms path, a new connection spends 100 ms before the request leaves.
The server keeps a record of each half-opened connection, which an attacker can exploit by sending floods of SYNs and never completing them, a SYN flood. Most systems defend with SYN cookies, which encode the state in the server's starting sequence number instead of storing it.
← → move through sections and cards