---
description: What is TCP Three-Way Hand Shake? TCP 3-way handshake or three-way handshake is a process which is used in a TCP/IP network to make a connection between server and client. This is a three-step process
title: TCP 3-Way Handshake (SYN, SYN-ACK,ACK)
image: https://www.guru99.com/images/tcp-3-way-handshake-1.png
---

 

[Skip to content](#main) 

**⚡ Smart Summary**

TCP 3-Way Handshake is the connection-setup ritual that every TCP session begins with. A client and server exchange SYN, SYN-ACK, and ACK packets to synchronise sequence numbers and confirm both sides are ready before a single byte of application data is sent.

* 📨 **Know the four message types:** SYN initiates, ACK confirms, SYN-ACK combines both, and FIN terminates a TCP connection.
* 🔁 **Follow the three steps:** client SYN → server SYN-ACK → client ACK; the session is established only after the third packet arrives.
* 🔢 **Sequence numbers matter:** each side picks an initial sequence number; the other side acknowledges it by adding one, which keeps the byte stream ordered.
* 🚪 **Plan for teardown:** after data transfer, TCP closes the connection with FIN/ACK pairs to release the socket on both ends.
* 🤖 **Use AI for packet analysis:** AI assistants explain Wireshark captures, flag missing ACKs, and highlight SYN floods or half-open connections.

[ Read More ](javascript:void%280%29;) 

![TCP 3-Way Handshake](https://www.guru99.com/images/tcp-3-way-handshake-1.png)

## What is the TCP Three-Way Handshake?

The **TCP Three-Way Handshake** is the procedure a client and a server use on a [TCP/IP network](https://www.guru99.com/tcp-ip-model.html) to set up a reliable connection before any application data is exchanged. As the name implies, it consists of three steps in which both sides exchange synchronisation (SYN) and acknowledgment (ACK) packets and agree on the initial sequence numbers they will use.

The handshake is designed so that both endpoints can initiate, negotiate, and tear down TCP sockets symmetrically. Once the handshake completes, the connection is full-duplex — both sides can send and receive in parallel until either issues a FIN to close the session.

## TCP Message Types

Four control flags appear repeatedly during the handshake and teardown.

| Message     | Description                                                                             |
| ----------- | --------------------------------------------------------------------------------------- |
| **SYN**     | Initiates a connection and synchronises sequence numbers between devices.               |
| **ACK**     | Confirms to the other side that the previous segment was received.                      |
| **SYN-ACK** | A combined message — a SYN from the local device plus an ACK of the peer’s earlier SYN. |
| **FIN**     | Used to terminate a connection gracefully.                                              |

## TCP Three-Way Handshake Process

TCP traffic always begins with a three-way handshake. The client initiates the conversation by requesting a session with the server.

[](https://www.guru99.com/images/1/092119%5F0753%5FTCP3WayHand1.png)

_3-way handshake diagram._

* **Step 1 — SYN:** The client sends a segment with the SYN flag set. It tells the server “I want to start communicating” and proposes an initial sequence number.
* **Step 2 — SYN-ACK:** The server responds with a segment in which both SYN and ACK flags are set. The ACK acknowledges the client’s SYN, and the SYN proposes the server’s own initial sequence number.
* **Step 3 — ACK:** The client acknowledges the server’s SYN-ACK with a final ACK. The connection is now established, and both sides can start transmitting application data.

## Real-World Example

[](https://www.guru99.com/images/1/092119%5F0753%5FTCP3WayHand2.png)

Here is a worked example with concrete sequence numbers.

* Host X starts the connection by sending a TCP SYN packet to the server. The packet carries a random initial sequence number — for example, `4321` — that marks the beginning of the byte stream Host X will send.
* The server receives the SYN and replies with a SYN-ACK. The ACK number is Host X’s sequence number incremented by 1 (`4322`), and the SYN proposes the server’s own initial sequence number.
* Host X replies with a final ACK whose acknowledgment number is the server’s sequence number incremented by 1.

Once data exchange completes, TCP tears down the connection with a four-way FIN/ACK sequence so both endpoints can release the socket cleanly.

### RELATED ARTICLES

* [Hub vs Switch – Difference Between Them ](https://www.guru99.com/hub-vs-switch.html "Hub vs Switch – Difference Between Them")
* [Top 53 ITIL Interview Questions and Answers (PDF) ](https://www.guru99.com/itil-interview-questions-answers.html "Top 53 ITIL Interview Questions and Answers (PDF)")
* [What is Network Security Key? How to Find on Router, Windows ](https://www.guru99.com/network-security-key.html "What is Network Security Key? How to Find on Router, Windows")
* [What is Wildcard Mask? How to Calculate Wildcard Mask ](https://www.guru99.com/wildcard-mask-calculator.html "What is Wildcard Mask? How to Calculate Wildcard Mask")

## Why TCP Needs a Three-Way Handshake

The handshake is not just a formality — it solves three concrete problems that come with reliable byte-stream transport:

* **Sequence-number synchronisation:** both peers learn the initial sequence number of the other side, which is what TCP uses to detect lost or out-of-order segments.
* **Connection-state agreement:** the third ACK confirms that the server’s SYN-ACK arrived, so neither side starts sending data until both are in the _ESTABLISHED_ state.
* **Duplicate-packet protection:** random initial sequence numbers and timed handshake states stop stale segments from a previous session being accepted by mistake.

## Common Issues with the TCP Handshake

The handshake is robust but it does break down in identifiable ways. Network engineers usually see one of the following:

* **SYN flood attacks:** a malicious client sends thousands of SYNs without replying to SYN-ACKs, exhausting the server’s connection table. SYN cookies are the standard defence.
* **Half-open connections:** when the third ACK is lost the connection lingers half-open and is eventually cleaned up by a timeout.
* **Firewall or NAT mid-flight drops:** stateful middleboxes that lose state can drop SYN-ACK packets and leave the client retrying.
* **RST resets:** if the server is not listening on the requested port it answers a SYN with an RST, which closes the attempt immediately.

## FAQs

⚡ Why does TCP use three messages instead of two?

Two messages cannot prove that both sides agreed on initial sequence numbers and are ready to send. The third ACK confirms the server’s SYN-ACK arrived, ensuring both endpoints reach the ESTABLISHED state before data flows.

🚀 What is the difference between SYN and SYN-ACK?

SYN is a single flag that opens the conversation and proposes an initial sequence number. SYN-ACK combines a SYN with an acknowledgment of the peer’s earlier SYN, completing the synchronisation in one packet.

💡 What is a SYN flood attack?

A SYN flood overwhelms a server by sending many SYN packets without completing the handshake. Half-open connections fill the backlog queue and block legitimate users. SYN cookies are the standard mitigation.

🔒 How does TCP close a connection?

TCP closes a connection with a four-way handshake of FIN and ACK exchanges. Each direction is closed independently, which lets one side finish sending data even after the other side has closed its half.

📐 What is the initial sequence number (ISN)?

The initial sequence number is a randomly chosen 32-bit value each endpoint picks for its own byte stream. It seeds the counter used to detect missing or duplicate segments and to defend against spoofed packets.

⏱️ Does UDP use a handshake too?

No. UDP is connectionless and sends datagrams without any handshake. That makes it faster and lighter than TCP, but applications must handle reliability, ordering, and congestion control themselves.

🤖 How does AI help diagnose TCP handshake issues?

AI assistants annotate packet captures, classify retransmits and RSTs, and detect SYN floods. They translate Wireshark filters into plain English and recommend the next diagnostic step for connectivity issues.

✍️ Can AI generate a script to test a TCP handshake?

Yes. AI coding assistants turn a plain-English request into a Python Scapy or netcat script that triggers and inspects the three-way handshake, then explain each line so engineers can review before running it.

#### Summarize this post with:

ChatGPT Perplexity Grok Google AI 

**Stay Updated on AI** **Get Weekly AI Skills, Trends, Actionable Advice.** 

##### Sign up for the newsletter

Subscribe for Free 

You have successfully subscribed.  
Please check your inbox. 

![AI-Newsletter]() Chosen by over **350,000+** professionals 

[Scroll to top ](#wrapper)Scroll to top 

× 

Toggle Menu Close 

Search for: 

Search

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.guru99.com/#organization","name":"Guru99","sameAs":["https://www.facebook.com/Guru99Official","https://twitter.com/guru99com"],"logo":{"@type":"ImageObject","@id":"https://www.guru99.com/#logo","url":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","contentUrl":"https://www.guru99.com/images/guru99-logo-v1-150x59.png","caption":"Guru99","inLanguage":"en-US"}},{"@type":"WebSite","@id":"https://www.guru99.com/#website","url":"https://www.guru99.com","name":"Guru99","publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.guru99.com/images/tcp-3-way-handshake-1.png","url":"https://www.guru99.com/images/tcp-3-way-handshake-1.png","width":"600","height":"250","inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://www.guru99.com/tcp-3-way-handshake.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","item":{"@id":"https://www.guru99.com","name":"Home"}},{"@type":"ListItem","position":"2","item":{"@id":"https://www.guru99.com/networking","name":"Networking"}},{"@type":"ListItem","position":"3","item":{"@id":"https://www.guru99.com/tcp-3-way-handshake.html","name":"TCP 3-Way Handshake (SYN, SYN-ACK,ACK)"}}]},{"@type":"WebPage","@id":"https://www.guru99.com/tcp-3-way-handshake.html#webpage","url":"https://www.guru99.com/tcp-3-way-handshake.html","name":"TCP 3-Way Handshake (SYN, SYN-ACK,ACK)","dateModified":"2026-06-02T11:10:46+05:30","isPartOf":{"@id":"https://www.guru99.com/#website"},"primaryImageOfPage":{"@id":"https://www.guru99.com/images/tcp-3-way-handshake-1.png"},"inLanguage":"en-US","breadcrumb":{"@id":"https://www.guru99.com/tcp-3-way-handshake.html#breadcrumb"}},{"@type":"Person","@id":"https://www.guru99.com/author/bryce","name":"Bryce Leo","description":"I'm Bryce Leo, an IT Specialist with expertise in network administration and cybersecurity, committed to enhancing IT infrastructure.","url":"https://www.guru99.com/author/bryce","image":{"@type":"ImageObject","@id":"https://www.guru99.com/images/bryce-leo-author.png","url":"https://www.guru99.com/images/bryce-leo-author.png","caption":"Bryce Leo","inLanguage":"en-US"},"worksFor":{"@id":"https://www.guru99.com/#organization"}},{"articleSection":"Networking","headline":"TCP 3-Way Handshake (SYN, SYN-ACK,ACK)","description":"What is TCP Three-Way Hand Shake? TCP 3-way handshake or three-way handshake is a process which is used in a TCP/IP network to make a connection between server and client. This is a three-step process","keywords":"network, hacking","speakable":{"@type":"SpeakableSpecification","cssSelector":[".entry-title",".summary"]},"@type":"Article","author":{"@id":"https://www.guru99.com/author/bryce","name":"Bryce Leo"},"dateModified":"2026-06-02T11:10:46+05:30","image":{"@id":"https://www.guru99.com/images/tcp-3-way-handshake-1.png"},"copyrightYear":"2026","name":"TCP 3-Way Handshake (SYN, SYN-ACK,ACK)","subjectOf":[{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Why does TCP use three messages instead of two?","acceptedAnswer":{"@type":"Answer","text":"Two messages cannot prove that both sides agreed on initial sequence numbers and are ready to send. The third ACK confirms the server's SYN-ACK arrived, ensuring both endpoints reach the ESTABLISHED state before data flows."}},{"@type":"Question","name":"What is the difference between SYN and SYN-ACK?","acceptedAnswer":{"@type":"Answer","text":"SYN is a single flag that opens the conversation and proposes an initial sequence number. SYN-ACK combines a SYN with an acknowledgment of the peer's earlier SYN, completing the synchronisation in one packet."}},{"@type":"Question","name":"What is a SYN flood attack?","acceptedAnswer":{"@type":"Answer","text":"A SYN flood overwhelms a server by sending many SYN packets without completing the handshake. Half-open connections fill the backlog queue and block legitimate users. SYN cookies are the standard mitigation."}},{"@type":"Question","name":"How does TCP close a connection?","acceptedAnswer":{"@type":"Answer","text":"TCP closes a connection with a four-way handshake of FIN and ACK exchanges. Each direction is closed independently, which lets one side finish sending data even after the other side has closed its half."}},{"@type":"Question","name":"What is the initial sequence number (ISN)?","acceptedAnswer":{"@type":"Answer","text":"The initial sequence number is a randomly chosen 32-bit value each endpoint picks for its own byte stream. It seeds the counter used to detect missing or duplicate segments and to defend against spoofed packets."}},{"@type":"Question","name":"Does UDP use a handshake too?","acceptedAnswer":{"@type":"Answer","text":"No. UDP is connectionless and sends datagrams without any handshake. That makes it faster and lighter than TCP, but applications must handle reliability, ordering, and congestion control themselves."}},{"@type":"Question","name":"How does AI help diagnose TCP handshake issues?","acceptedAnswer":{"@type":"Answer","text":"AI assistants annotate packet captures, classify retransmits and RSTs, and detect SYN floods. They translate Wireshark filters into plain English and recommend the next diagnostic step for connectivity issues."}},{"@type":"Question","name":"Can AI generate a script to test a TCP handshake?","acceptedAnswer":{"@type":"Answer","text":"Yes. AI coding assistants turn a plain-English request into a Python Scapy or netcat script that triggers and inspects the three-way handshake, then explain each line so engineers can review before running it."}}]}],"@id":"https://www.guru99.com/tcp-3-way-handshake.html#schema-1107830","isPartOf":{"@id":"https://www.guru99.com/tcp-3-way-handshake.html#webpage"},"publisher":{"@id":"https://www.guru99.com/#organization"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://www.guru99.com/tcp-3-way-handshake.html#webpage"}}]}
```