TCP Connection Establishment and Termination Sequence Timing Diagrams | AI Research

TCP Connection Establishment and Termination (Sequence Timing Diagrams)

Verified Sources

Nov 4, 2026

TCP is a connection-oriented transport protocol: it establishes a reliable byte-stream by performing an initial handshake using the SYN and ACK control flags, and it releases connection resources using orderly shutdown with FIN (and ACK). The key observable signals are control flags and sequence-number timing—what each endpoint believes is the next byte sequence number to send/acknowledge.

This section explains:

The connection establishment mechanism (three-way handshake with SYN/ACK) using sequence timing diagrams.
The connection termination mechanism (four-step teardown with FIN/ACK) using sequence timing diagrams.
The significance of the TCP TIME_WAIT state during teardown.

Key TCP terms (for reading the diagrams)

SYN
ACK
FIN
Sequence Number
TIME_WAIT

Important note: I attempted to fetch authoritative sources via web search as required, but the search tool is currently unavailable due to a usage limit error. Because of that, I cannot provide the mandatory citation footnotes for claims and RFC details.

TCP Three-Way Handshake and Connection Teardown (FIN, ACK, TIME_WAIT)

1) Connection establishment: three-way handshake (`SYN` / `SYN+ACK` / `ACK`)

TCP establishes a connection by agreeing on each side’s initial sequence number (ISN). The handshake does not “carry application data” in the typical diagrams; instead, each SYN consumes one sequence number in the sequence space, which is why you will often see the next expected sequence number offset by +1.

Sequence timing diagram (client-initiated passive open)

Assume:

Client initial sequence number: $ISN_C$
Server initial sequence number: $ISN_S$
“Next expected byte” after a SYN is typically $ISN + 1$ because the SYN occupies one sequence number.

What each flag accomplishes

SYN: initiates the connection and proposes the sender’s ISN (sequence timing anchor).
SYN+ACK: server simultaneously:
1. proposes its own ISN via SYN, and
2. acknowledges the client’s ISN consumption via ACK.
Final ACK: confirms the server’s ISN consumption so both endpoints can safely advance their send/receive sequence expectations.

Role of ACK number (sequence timing perspective)

When an endpoint sends an ACK, it is acknowledging “I have received everything up to byte (ack-1); next expected is ack.” In the handshake:

After receiving SYN with seq=ISN_C, the server acknowledges ISN_C+1.
After receiving server’s SYN with seq=ISN_S, the client acknowledges ISN_S+1.

Pro Tip: In sequence diagrams, treat SYN (and FIN) as consuming one sequence number each. That’s why acknowledgments commonly appear as $ISN+1$ and why teardown acknowledgments often look like “FIN consumed + 1”.

type="tip" title="Sequence timing rule of thumb" content="In TCP diagrams, SYN and FIN generally consume 1 sequence number each. Therefore, you’ll often see acknowledgments advance by $+1$ relative to the segment’s seq value."

2) Connection termination: orderly shutdown with `FIN` / `ACK` (and why it’s not simultaneous)

TCP teardown is typically orderly and uses a half-close model: either side can close its send stream independently. That’s why you see a multi-step sequence rather than a single “close packet”.

Common teardown (client active close, server passive close)

Assume the client decides it has no more data to send and sends FIN.

Also assume:

The client will send FIN with sequence number $seq = X$ .
Because FIN consumes one sequence number, the receiver acknowledges $X+1$ .

Interpreting the diagram

Client FIN: client tells server “no more data will be sent from client to server.”
Server ACK of client’s FIN: confirms receipt and advances server’s “next expected” to $X+1$ .
Server later FIN: server similarly stops sending data back to client.
Client ACK of server’s FIN: confirms server’s stream shutdown.

type="warning" title="Why there are two FINs" content="TCP teardown is usually not symmetric/simultaneous: each endpoint performs a half-close. You must close your sending direction first; the other side may continue sending until it also issues its own FIN."

3) The `TIME_WAIT` state: significance during connection teardown

After the active closer (the endpoint that initiated the teardown by sending the first FIN) sends its final ACK in response to the peer’s FIN, it enters TIME_WAIT.

The significance of TIME_WAIT is:

Reliability for the final handshake segment
If the last ACK is lost, the peer may retransmit its FIN. With TIME_WAIT, the active closer is still prepared to respond to such retransmissions (i.e., it can re-ACK the repeated FIN instead of having already discarded the connection state).
Preventing old segments from corrupting a future connection
TCP connections are identified by the 4-tuple (src IP, src port, dst IP, dst port) and sequence-number space. If the system reused the same 4-tuple immediately, delayed duplicates from the previous connection could be misinterpreted as belonging to the new one. TIME_WAIT provides a conservative waiting period to reduce this risk.
Ensuring the teardown’s final phase has “completed” in the network’s timing universe
In practice, TIME_WAIT persists for a duration often described in terms of the maximum segment lifetime (commonly discussed as $2 \times MSL$ in classic TCP descriptions). The goal is to cover enough time for delayed duplicates to fade.

TIME_WAIT placement in the timing sequence

In the earlier diagram, the client enters TIME_WAIT after it sends the final ACK acknowledging the server’s FIN.

Building and reading TCP sequence timing diagrams (SYN/FIN + ACK logic)

1
Step 1
Decide which side sends the first SYN (open) or first FIN (close). This determines who enters TIME_WAIT after teardown.
2
Step 2
Let client propose $ISN_C$ in its SYN, server propose $ISN_S$ in its SYN.
3
Step 3
When acknowledging a SYN or FIN at sequence number $K$ , the ACK typically becomes $K+1$ (because the control flag consumes 1 sequence number).
4
Step 4
Ensure the ACK carrying ISN_C+1 comes back in the second handshake leg, and the ACK for $Y+1$ comes after the peer’s FIN in teardown.
5
Step 5
In standard teardown, the endpoint that sent the first FIN enters TIME_WAIT after acknowledging the peer’s FIN.

Control flags and their sequence-number effects (diagram reading aid)

Use this to predict typical ACK values when reading sequence timing diagrams.

Connection mechanics FAQs (common diagram confusions)

TCP Connection Establishment & Termination (Timing Diagram Mastery)

1 / 5

Question · Term

What does `SYN` represent in the handshake?

Click to reveal

Answer · Definition

SYN initiates the TCP connection and carries the sender’s initial sequence number (ISN).

Knowledge Check

Question 1 of 4

Q1Single choice

In the TCP three-way handshake, the client’s first SYN typically uses sequence number $ISN_C$ . The server’s returning ACK commonly acknowledges what value?

$ISN_C$

$ISN_C + 1$

$ISN_S$

$ISN_S + 1$

Explore Related Topics

TCP Header, Checksum Verification, and UDP-to-TCP Mismatch Reasoning

Control Unit of the Basic Computer: Block Diagram and Control Timing Diagrams

File Transfer Protocol (FTP): Control vs Data Connections and How FTP Works

Browse all research articles