Coursify

How TCP Connection Establishment Works in the Transport Layer (Three-Way Handshake)

How TCP Connection Establishment Works in the Transport Layer (Three-Way Handshake)

Verified Sources
Nov 3, 2026

TCP is a connection-oriented transport-layer protocol: before application data is delivered, the endpoints establish a TCP connection by synchronizing state and sequence numbers via a keywordSYN[/{def}] exchange, commonly called the keywordthree-way handshake[/{def}]. The three segments are: client SYN → server SYN-ACK → client ACK, after which the connection enters the keywordESTABLISHED[/{def}] state.2

A key purpose of the handshake is to agree on initial sequence numbers and avoid confusion from old/duplicate connection attempts; TCP uses a state machine to track progress through stages like keywordSYN-SENT[/{def}] and keywordSYN-RECEIVED[/{def}].

Footnotes

  1. Transmission Control Protocol - Wikipedia - Overview of TCP as connection-oriented and related state concepts. ↩

  2. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩

  3. RFC 9293 - Transmission Control Protocol (TCP) - Defines TCP state machine states such as SYN-SENT, SYN-RECEIVED, ESTABLISHED. ↩

TCP Three-Way Handshake Explained with Wireshark

Packet fields that matter during establishment

During the handshake, each TCP segment carries (at minimum) control flags and sequence/acknowledgment information:

  • The first keywordSYN[/{def}] communicates the client’s initial sequence number (ISN) to the server.
  • The keywordACK[/{def}] in the SYN-ACK confirms receipt of the client’s SYN by acknowledging ISNc+1_c+1 (because the SYN itself consumes one sequence number).
  • The server’s own keywordSYN-ACK[/{def}] also advertises the server’s initial sequence number (ISNs_s).
  • The final keywordACK[/{def}] acknowledges ISNs+1_s+1, completing synchronization so both sides can start the data transfer phase.2

Diagram takeaway: by the end of the third segment, both endpoints have learned the other endpoint’s ISN and have acknowledged each other’s “next expected byte,” allowing reliable ordered delivery to begin.2

Footnotes

  1. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩ ↩2

  2. OpenPCAP - TCP 3-Way Handshake Explained: SYN, SYN-ACK, ACK - Packet-level handshake explanation with acknowledgement/sequence interpretation. ↩ ↩2

Step-by-step: Establishing a TCP connection (three-way handshake)

  1. 1
    Step 1

    The client selects an initial sequence number (ISNc_c) and sends a TCP segment with the SYN flag set. The client transitions to SYN-SENT, waiting for the server response.2

    Footnotes

    1. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩

    2. RFC 9293 - Transmission Control Protocol (TCP) - Defines TCP state machine states such as SYN-SENT, SYN-RECEIVED, ESTABLISHED. ↩

  2. 2
    Step 2

    After receiving the SYN, the server sends a segment with both SYN and ACK flags set: it acknowledges the client’s SYN as ACK=ISNc+1ACK=ISN_c+1 and also includes its own ISNs_s. The server is then in SYN-RECEIVED, waiting for the final ACK.2

    Footnotes

    1. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩

    2. RFC 9293 - Transmission Control Protocol (TCP) - Defines TCP state machine states such as SYN-SENT, SYN-RECEIVED, ESTABLISHED. ↩

  3. 3
    Step 3

    The client sends an ACK that acknowledges the server’s SYN as ACK=ISNs+1ACK=ISN_s+1. Once this final confirmation is processed, both endpoints enter the ESTABLISHED state and can deliver application data.2

    Footnotes

    1. Transmission Control Protocol - Wikipedia - Overview of TCP as connection-oriented and related state concepts. ↩

    2. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩

  4. 4
    Step 4

    With the handshake complete, TCP delivers received payload to the application and can perform ongoing reliability mechanisms (e.g., acknowledgments, retransmissions) during the data phase.2

    Footnotes

    1. Transmission Control Protocol - Wikipedia - Overview of TCP as connection-oriented and related state concepts. ↩

    2. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩

TCP connection states around establishment

TCP maintains a finite state machine in each endpoint. For establishment, the most relevant states are:

  • keywordLISTEN[/{def}]
  • keywordSYN-SENT[/{def}]
  • keywordSYN-RECEIVED[/{def}]
  • keywordESTABLISHED[/{def}]2

This state tracking is important operationally: you can observe these states in systems tooling (e.g., via TCP state views) to infer whether the handshake is progressing or stuck.2

Footnotes

  1. RFC 9293 - Transmission Control Protocol (TCP) - Defines TCP state machine states such as SYN-SENT, SYN-RECEIVED, ESTABLISHED. ↩ ↩2

  2. OpenPCAP - TCP 3-Way Handshake Explained: SYN, SYN-ACK, ACK - Packet-level handshake explanation with acknowledgement/sequence interpretation. ↩

  3. PacketMentor - TCP Connection States - Practical mapping of key TCP states (including SYN-SENT, SYN-RECEIVED, ESTABLISHED). ↩

Handshake segments vs. what each one accomplishes

Each segment establishes or confirms synchronization/sequence expectations.

Why sequence numbers are initialized first

The handshake’s main job is to synchronize sequence spaces (ISNs). That’s why the SYN and SYN-ACK each carry ISN information and the ACK numbers confirm “next expected byte.” This prepares TCP for reliable, in-order delivery.2

Footnotes

  1. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩

  2. OpenPCAP - TCP 3-Way Handshake Explained: SYN, SYN-ACK, ACK - Packet-level handshake explanation with acknowledgement/sequence interpretation. ↩

Handshake delay and “half-open” connections

Before ESTABLISHED, endpoints may appear in intermediate states (e.g., SYN-SENT or SYN-RECEIVED). If replies are dropped or delayed, connections may not complete, leaving “half-open” handshakes that can be diagnosed by observing TCP state behavior.2

Footnotes

  1. RFC 9293 - Transmission Control Protocol (TCP) - Defines TCP state machine states such as SYN-SENT, SYN-RECEIVED, ESTABLISHED. ↩

  2. PacketMentor - TCP Connection States - Practical mapping of key TCP states (including SYN-SENT, SYN-RECEIVED, ESTABLISHED). ↩

Common edge cases and extensions

TCP Connection Establishment (Quick Recall)

1 / 4
Question · Term

What are the three segments in the TCP connection establishment?

Click to reveal
Answer · Definition

SYN (client→server), SYN-ACK (server→client), ACK (client→server).2

Footnotes

  1. Transmission Control Protocol - Wikipedia - Overview of TCP as connection-oriented and related state concepts. ↩

  2. Intronetworks.cs.luc.edu - TCP Transport Basics — An Introduction to Computer Networks - Describes SYN / SYN+ACK / ACK handshake and related sequencing/state notes. ↩

Knowledge Check

Question 1 of 4
Q1Single choice

In a standard TCP three-way handshake, which segment completes the synchronization so the connection can enter ESTABLISHED?

Explore Related Topics

1

TCP Characterization: Layer, Connection Semantics, and Reliability

2

File Transfer Protocol (FTP): Control vs Data Connections and How FTP Works

3

TCP Three-Way Handshake: Purpose of the SYN / SYN+ACK / ACK Exchange

Browse all research articles