TCP Handshake & Termination

TCP is connection-oriented — before data flows, both sides synchronize. This is the three-way handshake.

3-Way Handshake (Connection Establishment)

Client (Active open)          Server (Passive open)
       |                            |
       |─── SYN (seq=X) ──────────→│  Step 1: Client sends SYN, picks random seq X
       |                            |
       │←─ SYN-ACK (seq=Y, ack=X+1)─│  Step 2: Server acknowledges X, sends its own SYN with seq Y
       |                            |
       │─── ACK (seq=X+1, ack=Y+1) ─→│  Step 3: Client acknowledges Y. Connection established

• SYN = Synchronize sequence numbers
• ACK = Acknowledgment
• Sequence numbers are random (ISN — Initial Sequence Number) to prevent spoofing

4-Way Termination (Connection Close)

TCP is full-duplex — each direction closes independently.

Client                            Server
  │─── FIN (seq=M) ────────────→│  Client says "I'm done sending"
  │←─ ACK (seq=N, ack=M+1) ─────│  Server ACKs (but may still send data)
  │                              │  (Server continues sending data if needed)
  │←─ FIN (seq=N, ack=M+1) ─────│  Server says "I'm done sending too"
  │─── ACK (seq=M+1, ack=N+1) ─→│  Client ACKs. Connection closed

After the last ACK, the client enters TIME_WAIT state (2×MSL = ~2 minutes) to ensure the server received the final ACK.

SYN Flood Attack

The attacker sends many SYN packets with spoofed source IPs. The server allocates resources (PCB) for each half-open connection and waits for the final ACK that never comes. The server’s connection table fills up, denying service to legitimate users.

Mitigation: SYN cookies — the server encodes connection state in the SYN-ACK sequence number itself, allocating no resources until the final ACK arrives.