The TCP three-way handshake, explained
Every TCP connection starts with the same three messages. Here is what they are, what they agree on, and how attackers abuse them, with links to the standards themselves.
- What it is
Three messages open a connection.
The client sends a SYN (short for synchronize). The server replies with a SYN-ACK: its own SYN plus an acknowledgment of the client's. The client answers with an ACK, and the connection is established. Two less common variations exist: both sides can open at the same time, and data can ride along on the SYN.
Source: RFC 9293 (TCP), section 3.5
- How it works
Both sides sync a starting number.
Each side picks an initial sequence number and sends it in its SYN. The other side confirms it by acknowledging that number plus one. From then on every byte has a sequence number, so every byte can be acknowledged, and anything lost can be retransmitted.
- Why it matters
Unfinished handshakes can lock users out.
In a SYN flood, an attacker sends a barrage of SYNs, often from spoofed addresses, and never completes the handshake. The server keeps each half-open connection in a backlog, and once the backlog is full, legitimate requests are rejected. Most systems defend against this with SYN cookies, described in the same RFC.
The takeaway: Three messages, SYN, SYN-ACK and ACK, let both sides agree on starting sequence numbers so every byte can be tracked. Handshakes that never finish are also the basis of one of the oldest denial-of-service attacks.
More short lessonsADIR also offers a free external pen test for cloud teams: see the offer.
Transcript
Before a TCP connection carries a single byte of data, the two sides trade three quick messages. Here's what they do. It's called the three-way handshake. The client sends a SYN, short for synchronize. The server replies with a SYN-ACK, its own SYN plus an acknowledgment. Then the client sends an ACK, and the connection is open. What they synchronize is sequence numbers. Each side picks a starting number and sends it in its SYN. The other side confirms it by acknowledging that number plus one. From then on, every byte gets a number, so every byte can be acknowledged, and anything lost can be sent again. That handshake can be abused. In a SYN flood, an attacker sends a barrage of SYNs, often from spoofed addresses, and never finishes the handshake. The server holds each half-open connection in a backlog, and once that backlog is full, real users get turned away. So, three messages: SYN, SYN-ACK, ACK. Both sides agree on starting numbers, so every byte is tracked. And handshakes that never finish can lock out real users.
Narrated with an AI voice.
