Coursify

TCP Connections: Establishment (Three-Way Handshake) and Release (Connection Termination)

TCP Connections: Establishment (Three-Way Handshake) and Release (Connection Termination)

Verified Sources
Nov 3, 2026

A TCP connection is established over an IP network using TCP. Each TCP segment carries control flags (e.g., SYN and FIN), along with sequence numbers that let peers order and acknowledge data.

A connection has two complementary lifecycle phases:

  1. Connection establishment: the sender and receiver synchronize initial sequence numbers using the three-way handshake.
  2. Connection release: one or both sides close the connection using FIN-based termination, after which TCP enters time-waiting states to avoid confusion from delayed segments. 2

Footnotes

  1. RFC 793 (Transmission Control Protocol) https://www.rfc-editor.org/rfc/rfc793 - Original TCP specification including establishment/termination behavior. ↩

  2. RFC 9293 (Transmission Control Protocol (TCP)) https://www.rfc-editor.org/rfc/rfc9293 - Updated TCP specifications and state-machine related behaviors including termination concepts. ↩

TCP Three-Way Handshake & Connection Termination (FIN/ACK) Overview

Key terms you will see in handshakes

  • SYN: initiates connection establishment.
  • ACK: confirms receipt of sequence-numbered bytes.
  • FIN: indicates no more data will be sent from that direction.
  • sequence number: identifies where a segment fits in the stream.
  • initial sequence number (ISN): allows independent, fresh numbering each connection.

These concepts are grounded in the original TCP specification and later state-machine clarifications. 3

Footnotes

  1. RFC 793 (Transmission Control Protocol) https://www.rfc-editor.org/rfc/rfc793 - Original TCP specification including establishment/termination behavior. ↩

  2. RFC 9293 (Transmission Control Protocol (TCP)) https://www.rfc-editor.org/rfc/rfc9293 - Updated TCP specifications and state-machine related behaviors including termination concepts. ↩

  3. RFC 9293 (TCP) TIME_WAIT discussion https://www.rfc-editor.org/rfc/rfc9293 - References TCP closure states and rationale including TIME_WAIT. ↩

TCP Connection Establishment (Three-Way Handshake)

  1. 1
    Step 1

    The client sends a segment with the SYN flag and an initial sequence number (ISN), starting the synchronization process. The SYN consumes one sequence-numbered byte.

  2. 2
    Step 2

    The server responds with SYN-ACK: it acknowledges the client’s SYN (ack = client_ISN + 1) and also includes its own ISN.

  3. 3
    Step 3

    "The client acknowledges the server’s SYN (ack = server_ISN + 1). After this ACK, the TCP connection is considered established and application data may be sent."

    Why three messages? Because both sides must (1) agree on each other’s willingness to communicate and (2) synchronize their initial sequence numbers so that subsequent byte-stream ordering and acknowledgments are correct. 2

    Footnotes

    1. RFC 793 (Transmission Control Protocol) https://www.rfc-editor.org/rfc/rfc793 - Original TCP specification including establishment/termination behavior. ↩

    2. Wireshark TCP handshake capture (general reference) https://www.wireshark.org/docs/ - Wireshark documentation describing interpreting TCP flags/handshakes in captures. ↩

State view (conceptual)

During establishment, each endpoint transitions from a “closed/listening” posture to an “established” posture after the handshake completes. TCP implementations follow formal connection-state machines; “established” occurs when both peers have acknowledged each other’s SYNs. 2

Footnotes

  1. RFC 9293 (Transmission Control Protocol (TCP)) https://www.rfc-editor.org/rfc/rfc9293 - Updated TCP specifications and state-machine related behaviors including termination concepts. ↩

  2. RFC 9293 (TCP) TIME_WAIT discussion https://www.rfc-editor.org/rfc/rfc9293 - References TCP closure states and rationale including TIME_WAIT. ↩

TCP Connection Release (Connection Termination)

“Release” in TCP typically means connection termination rather than an instantaneous teardown. TCP supports half-close: one direction can stop sending while still receiving in the other direction. The most common termination pattern is FIN/ACK exchange from each side, commonly described as a four-segment process when both endpoints close. 2

Note: Your prompt asks for “Connection Release using three way handshaking.” In standard TCP, termination is fundamentally driven by FIN/ACK, and when both peers actively close, the common pattern is effectively FIN, ACK, FIN, ACK (four segments). I’ll describe termination in the canonical FIN/ACK way while also mapping it to a “three-event” conceptual model. 2

Conceptual three “events”

  1. Active closer sends FIN to signal end-of-data for its direction.
  2. Passive closer ACKs that FIN.
  3. Passive closer sends its FIN; active closer ACKs it (finalizes closure for that direction).

This is still the classic FIN-based mechanism defined by TCP. 2

Footnotes

  1. RFC 793 (Transmission Control Protocol) https://www.rfc-editor.org/rfc/rfc793 - Original TCP specification including establishment/termination behavior. ↩ ↩2 ↩3

  2. RFC 9293 (Transmission Control Protocol (TCP)) https://www.rfc-editor.org/rfc/rfc9293 - Updated TCP specifications and state-machine related behaviors including termination concepts. ↩ ↩2 ↩3

TCP Connection Release (FIN/ACK Termination: canonical sequence)

  1. 1
    Step 1

    Endpoint A transmits a segment with the FIN flag (consumes one sequence number byte).

  2. 2
    Step 2

    Endpoint B responds with an ACK acknowledging the FIN (ack = A_FIN_seq + 1).

  3. 3
    Step 3

    When B is done sending, it transmits FIN with its own sequence number.

  4. 4
    Step 4

    "Endpoint A acknowledges B’s FIN; after completing the required acknowledgments, TCP can transition through closing states."

    During this process, implementations may enter TIME_WAIT (often on the active closer side) to handle delayed segments and ensure old duplicates do not corrupt a future connection reusing the same 4-tuple. 2

    Footnotes

    1. RFC 9293 (Transmission Control Protocol (TCP)) https://www.rfc-editor.org/rfc/rfc9293 - Updated TCP specifications and state-machine related behaviors including termination concepts. ↩

    2. RFC 9293 (TCP) TIME_WAIT discussion https://www.rfc-editor.org/rfc/rfc9293 - References TCP closure states and rationale including TIME_WAIT. ↩

How to interpret FIN in a byte stream

FIN is not “a packet of meaning” only—it is also a sequence-numbered event. Treating FIN as consuming a sequence number helps reason about ACK values and ordering.

Handshake ≠ termination

The three-way handshake is for establishment. TCP termination is not normally described as a symmetric three-way handshake; it is driven by FIN/ACK and half-close, producing a common 4-segment exchange when both sides close actively.

Practical packet-level mapping (what you see on the wire)

When capturing traffic (e.g., with Wireshark), a typical establishment looks like:

  • client → server: SYN
  • server → client: SYN, ACK
  • client → server: ACK

And a typical active close looks like:

  • close initiator → peer: FIN, ACK? (often paired with ACK if piggybacking)
  • peer → initiator: ACK
  • peer → initiator: FIN
  • initiator → peer: ACK

Exact flag combinations can vary slightly with whether ACKs are piggybacked on data/FIN segments, but the sequence-number and acknowledgment logic stays consistent with TCP’s semantics.

Footnotes

  1. Wireshark TCP handshake capture (general reference) https://www.wireshark.org/docs/ - Wireshark documentation describing interpreting TCP flags/handshakes in captures. ↩

TCP Lifecycle Roadmap

SYN-Sent / LISTEN

1

Client begins synchronization with SYN; server is ready to receive SYN (LISTEN/receiving state)."

SYN-Received

2

Server answers with SYN-ACK; both sides now know each other’s ISNs (at least partially)."

Established

3

Client sends final ACK; full-duplex data transfer can start."

Half-close / Closing

4

One side sends FIN; the other ACKs and may still send remaining data."

Final ACK & TIME_WAIT

5

Closure completes with required ACKs; TIME_WAIT protects against delayed segments."

Segment Roles in TCP Establishment vs Termination

Counts reflect the common canonical sequence when both sides actively close.

Common edge cases and nuances

TCP Handshake & Release (Quick Recall)

1 / 4
Question · Term

What does SYN accomplish in TCP?

Click to reveal
Answer · Definition

It synchronizes initial sequence numbers and indicates intent to establish a connection.

Knowledge Check

Question 1 of 4
Q1Single choice

In TCP connection establishment (three-way handshake), which segment completes the handshake?

Explore Related Topics

1

TCP Header, Checksum Verification, and UDP-to-TCP Mismatch Reasoning

2

File Transfer Protocol (FTP): Control vs Data Connections and How FTP Works

3

TCP: Establishing a Reliable Connection Over an Unreliable Network

Browse all research articles