TCP Three-Way Handshake, Termination & States | APPSC Notes

Computer Networks • Transport Layer • Lesson 06

TCP Three-Way Handshake, Connection Establishment and Release, SYN Flooding, TCP State Diagram and Numerical Problems

A complete illustrated tutorial with the TCP SYN–SYN+ACK–ACK exchange, four-segment termination, half-close, 11 TCP states, SYN flood defense, sequence-number calculations and competitive exam MCQs.

TCP HandshakeFIN & TIME_WAIT11 TCP StatesSYN CookiesNumericals & MCQs

TCP is connection-oriented: before ordinary data exchange, two TCP endpoints synchronize initial sequence numbers. When communication ends, each direction is closed, normally using FIN and ACK segments. Understanding how sequence and acknowledgement numbers change is essential for APPSC Assistant Professor, RGUKT Lecturer, UGC NET and GATE.

Contents of Lesson 06

1. Why TCP establishes connections
2. Three-way handshake with animation
3. Simultaneous open
4. Data, ACK and sequence numbers
5. Four-segment and three-segment release
6. Half-close and simultaneous close
7. TCP 11 states and state paths
8. TIME_WAIT and reset (RST)
9. SYN flood and SYN cookies
10. Solved numerical problems
11. Exam MCQs
12. FAQs and textbook references

1. Why Does TCP Need Connection Establishment?

A TCP connection is a logical association between two transport endpoints. It is not a dedicated physical circuit. The underlying Internet Protocol may deliver individual segments by different paths, out of order or not at all; TCP restores the reliable byte-stream abstraction.

Synchronize

Each endpoint chooses an Initial Sequence Number (ISN) and learns the peer's ISN.

Confirm reachability

Each side receives and acknowledges the other's SYN before the normal established state.

Maintain state

TCP maintains buffers, sequence numbers, windows and other connection-specific information.

Three phases of a TCP connection: (1) connection establishment, (2) bidirectional data transfer, (3) connection termination. These phases are explained in both Tanenbaum §6.5 and Forouzan §23.3.

A connection is conventionally identified by a five-tuple: transport protocol, source IP, source port, destination IP and destination port. Two clients can connect to the same server port without becoming the same TCP connection.

2. TCP Three-Way Handshake (SYN → SYN+ACK → ACK)

Step 1 — Client sends SYN: an active opener chooses its initial sequence number x and sends SYN=1, SEQ=x. Since ACK is not set, its acknowledgement field is not valid.

Step 2 — Server sends SYN+ACK: a listening server chooses y and responds with SYN=1, ACK=1, SEQ=y, ACK=x+1.

Step 3 — Client sends ACK: the client acknowledges the server's SYN with ACK=1, SEQ=x+1, ACK=y+1. In the normal no-data case, this final pure ACK consumes no additional sequence number.

Pause / resume the illustrative packet animations

Animated three-way handshake

Client (active open)Server (passive open)

━━━━━━━━━━ ➜

1. SYN

SEQ = x

⬅ ━━━━━━━━━━

2. SYN + ACK

SEQ = y, ACK = x + 1

━━━━━━━━━━ ➜

3. ACK

SEQ = x + 1, ACK = y + 1

The three lines show the chronological TCP exchange; the repeating CSS animation is illustrative, not a timing-accurate packet capture. Reference: Tanenbaum Figure 6-37(a) and Forouzan Figure 23.18.

Client SYN: x → server ACK: x + 1   |   Server SYN: y → client ACK: y + 1

Critical exam rule: SYN consumes one sequence number even if it carries no application data. A pure ACK normally consumes zero. Some wording in Forouzan's description of the final ACK is inconsistent with its SYN-consumption rule; the equations here follow the standard sequencing also shown in Tanenbaum's Figure 6-37.

Step	Segment	Sequence	ACK number	New state
1	Client SYN	x	Not valid	Client: SYN-SENT
2	Server SYN+ACK	y	x+1	Server: SYN-RECEIVED
3	Client ACK	x+1	y+1	Client established; server becomes established upon receipt

3. Simultaneous TCP Connection Establishment

Normally one endpoint actively opens and the other passively listens. In a simultaneous open, both sides initiate an active open. Each side sends SYN, receives the other's SYN and responds with synchronization/acknowledgement information. For the same socket pair, the result is one TCP connection, not two.

Host A: SYN(x) →

Host B: ← SYN(y)

Both acknowledge the peer SYN

One established connection

Textbook diagram: Tanenbaum Figure 6-37(b). The important contrast is simultaneous open versus ordinary passive/active open.

4. TCP Sequence and Acknowledgement Numbers During Data Transfer

TCP numbers individual bytes, not segments. Each direction has its own independent sequence space. After the three-way handshake, the first application-data byte typically uses ISN + 1.

Next expected byte = starting SEQ + number of contiguous data bytes

ACK value = next in-order byte expected from the opposite endpoint

For example, if a client sends bytes 1001–1500 (500 bytes), the server's cumulative acknowledgement is 1501. If the server also sends 300 bytes beginning at sequence 5001, the client's acknowledgement is 5301. The two ACK values refer to opposite streams.

1001–1500 received1501–2000 lost2001–2500 out of order

After the loss, cumulative ACK remains 1501 until bytes 1501–2000 arrive. Once the gap is filled, it can advance to 2501. SACK may separately indicate the out-of-order received range.

Remember: An ACK-only segment without SYN, FIN or payload does not advance the sender's sequence number. When a segment is retransmitted after loss, it reuses the original data sequence numbers rather than numbering the same bytes again.

5. TCP Connection Termination — FIN and ACK

Since TCP supports full-duplex communication, the two directions of a connection are normally closed independently. A TCP endpoint sending FIN says it has no more application data to send in that direction; it can still receive data until the peer finishes.

Normal four-segment close

Active closer (Client)Passive closer (Server)

━━━━━━━━━━ ➜

1. FIN + ACK

Client finishes sending; enters FIN-WAIT-1

⬅ ━━━━━━━━━━

2. ACK

Server acknowledges FIN; server enters CLOSE-WAIT

⬅ ━━━━━━━━━━

3. FIN + ACK

Server finishes sending; enters LAST-ACK

━━━━━━━━━━ ➜

4. ACK

Client enters TIME-WAIT; server closes on ACK

Simplified FIN/ACK sequence. FIN-bearing segments commonly also have ACK set; the essential control sequence is FIN → ACK → FIN → ACK. Tanenbaum §6.5.6.

Four-segment termination

FIN, ACK, FIN, ACK. The server can continue sending data after acknowledging the client's FIN.

Three-segment termination

FIN, combined FIN+ACK, ACK. This occurs when the passive closer is ready to close its sending direction promptly.

Sequence-space rule: FIN consumes one sequence number. For example, if a FIN has SEQ=7000 and contains no payload, the peer acknowledges it with ACK=7001. The ACK itself consumes none.

6. Half-Close and Simultaneous Close

6.1 Half-close

A half-close occurs when one side sends FIN but continues receiving. Consider a client sending all records for sorting to a server. The client finishes uploading and sends FIN; the server can continue sending the sorted result back before issuing its own FIN. Forouzan explains this through a half-close example (Figure 23.21).

Client finishes upload → FIN

Server ACKs; receives no more client data

Server sends result data back

Server FIN → Client ACK

6.2 Simultaneous close

If both endpoints send FIN before receiving the other's FIN, both may pass through the CLOSING state. The two FINs are acknowledged and the connection eventually terminates. This differs from the simultaneous open discussed earlier.

7. TCP Connection State Diagram — All 11 States

Tanenbaum's Figure 6-38 lists 11 states and Figure 6-39 models the transitions. For exam revision, first memorize the normal active-closer and passive-closer routes; then learn the exceptional CLOSING state.

Normal path — active opener and active closer

CLOSED→SYN-SENT→ESTABLISHED

CONNECT/SYN → receive SYN+ACK/send ACK

ESTABLISHED→FIN-WAIT-1→FIN-WAIT-2→TIME-WAIT→CLOSED

CLOSE/send FIN → receive ACK → receive FIN/send ACK → wait for 2 × maximum segment lifetime (historical description) → close

Conceptual sequence based on the normal path in Tanenbaum Figure 6-39; exceptional transition combinations are described below.

Normal path — passive server / passive closer

CLOSED→LISTEN→SYN-RECEIVED→ESTABLISHED

LISTEN → receive SYN/send SYN+ACK → receive ACK

ESTABLISHED→CLOSE-WAIT→LAST-ACK→CLOSED

Receive FIN/send ACK → local application CLOSE/send FIN → receive final ACK

The passive closer typically enters CLOSE-WAIT while the application decides when to finish its own sending direction.

TCP state	Meaning / reason	Typical trigger
CLOSED	No active or pending connection.	Initial / fully terminated
LISTEN	Wait for incoming connection request.	Passive open
SYN-SENT	Active opener sent SYN, waits for response.	CONNECT → send SYN
SYN-RECEIVED	SYN received; sent SYN+ACK, awaits final ACK.	Receive SYN
ESTABLISHED	Normal bidirectional application data transfer.	Handshake completed
FIN-WAIT-1	Sent FIN; waiting for its ACK or peer FIN.	Active close
FIN-WAIT-2	Own FIN acknowledged; waiting for peer FIN.	Receive ACK of FIN
CLOSE-WAIT	Peer sent FIN; local application may still send.	Receive FIN; send ACK
CLOSING	FINs cross; waiting for ACK of local FIN.	Simultaneous close
LAST-ACK	Passive closer sent FIN; waits for its ACK.	Local CLOSE after CLOSE-WAIT
TIME-WAIT	Final-ACK protection and expiry of old duplicates.	Active closer ACKs peer FIN

Mnemonic: Active closer: FIN-WAIT-1 → FIN-WAIT-2 → TIME-WAIT. Passive closer: CLOSE-WAIT → LAST-ACK. CLOSING is the crossed-FIN exceptional case.

8. TIME_WAIT, RST and Delayed Duplicate Segments

Why TIME_WAIT exists

The active closer waits after sending the final ACK because the ACK might be lost. Waiting allows it to retransmit the final ACK if the peer sends FIN again, and prevents old duplicate segments from being confused with a later connection using the same endpoints. Tanenbaum describes a wait of twice the maximum packet/segment lifetime in the classic model. This does not mean every operating system has a fixed universal TIME_WAIT duration.

RST versus FIN

FIN	RST
Graceful termination of one sending direction; normally acknowledged.	Abrupt reset, refusal or rejection of an invalid connection.
FIN consumes a sequence number.	Not the same as a graceful two-direction FIN close.

The connection establishment protocol must also deal with delayed duplicate segments. Unique initial sequence numbers and bounded segment lifetimes reduce the risk of mistakenly treating old packets as belonging to a new connection.

9. SYN Flooding Attack and SYN Cookies

A SYN flood is a denial-of-service attack in which many connection requests reach a listening TCP server but the handshakes are not completed. The server may accumulate half-open connection state and run short of available resources, affecting legitimate clients.

Conceptual SYN flood

Many apparent clients

SYN →
SYN →
SYN →
✕ No final ACK

Server
Half-open requests

Illustrative only: the attacker may spoof source addresses; an incomplete handshake is not proof that every SYN came from an attacker.

Defense: SYN cookies

As Tanenbaum explains, a server may construct a cryptographically computed initial sequence number from connection information and a secret instead of saving normal half-open state immediately. When a valid final ACK returns, the server checks the cookie and can allocate connection state.

Receive SYN

Generate SYN-cookie ISN

Send SYN+ACK without normal half-open allocation

Validate returned ACK

Create accepted connection

Correct scope: SYN cookies help mitigate server-state exhaustion; they do not eliminate every denial-of-service attack. The textbooks describe some option-handling restrictions associated with their time period. These are historical implementation details, not a claim that every current stack has identical limitations.

10. TCP Sequence and Acknowledgement Numbers — Solved Numericals

The following are original practice examples based on the textbook rules, not claims about previously asked APPSC/NET/GATE questions. Unless noted, examples use normal TCP data transfer without extra SYN/FIN bytes in the segment under discussion.

Example 1: Three-way handshake

Given: Client ISN = 1000, Server ISN = 5000.

Segment	SEQ	ACK
Client SYN	1000	Not valid
Server SYN+ACK	5000	1001
Client pure ACK	1001	5001

Answer: server ACK = 1001; final client ACK = 5001.

Example 2: ACK after data immediately following SYN

A client had ISN = 2000. After handshake it sends 1200 bytes of data in one segment, starting at SEQ = 2001.

ACK = 2001 + 1200 = 3201

Answer: ACK = 3201.

Example 3: Independent sequence spaces in full-duplex TCP

Client's first data byte is numbered 1501; it sends 500 bytes. Server's first data byte is numbered 8001; it sends 300 bytes. No loss.

Server ACK for client data = 1501 + 500 = 2001

Client ACK for server data = 8001 + 300 = 8301

Answer: Server ACK = 2001; Client ACK = 8301.

Example 4: Lost middle segment and cumulative ACK

TCP receives bytes 1000–1499 and 2000–2499 but bytes 1500–1999 are missing.

Before recovery: ACK remains 1500. After bytes 1500–1999 arrive: all bytes through 2499 are contiguous, so ACK becomes 2500.

Answer: 1500 before; 2500 after.

Example 5: FIN consumes one sequence number

The sender has transmitted all data through byte 7000. Its next sequence number is 7001, and it sends FIN without data.

FIN SEQ = 7001   ⇒   peer ACK = 7002

Answer: ACK = 7002.

Example 6: Three-segment termination

Client's FIN has SEQ = 5000. Server's next local SEQ is 9000. The server immediately sends FIN+ACK.

Client FIN → server ACK 5001. Server FIN+ACK → SEQ 9000, ACK 5001. Client's final pure ACK → SEQ 5001, ACK 9001.

Answer: three segments, with the final ACK = 9001.

Example 7: Retransmission does not renumber data

Segment SEQ = 4001 carries 300 bytes but is lost. The retransmission uses the same byte range 4001–4300.

Expected cumulative ACK = 4001 + 300 = 4301

Answer: retransmitted SEQ = 4001; ACK after receipt = 4301.

Example 8: Sequence-number wraparound

A segment starts at SEQ = 4,294,967,294 and carries four data bytes. TCP has a 32-bit sequence space.

Next SEQ = (4,294,967,294 + 4) mod 2³² = 2

Answer: ACK = 2 (modulo 2³²).

Example 9: Identify the states after FIN/ACK

Host A initiates closure and sends FIN. Host B ACKs it, but has not yet sent its own FIN.

Host A is FIN-WAIT-2. Host B is CLOSE-WAIT (assuming it has not yet closed locally).

Answer: A = FIN-WAIT-2; B = CLOSE-WAIT.

Fast numerical rules: (i) data length N advances SEQ by N, (ii) SYN advances by 1, (iii) FIN advances by 1, (iv) pure ACK advances by 0, (v) cumulative ACK reports the next missing in-order byte, (vi) sequence numbers wrap modulo 2³².

11. APPSC / UGC NET / GATE Practice MCQs

These are original practice questions aligned to the concepts prescribed by Assistant Professor / RGUKT syllabi. Expand Answer and explanation to self-check.

Exam tip: Distinguish connection establishment (3 segments) from normal termination (4 segments, possibly 3 if combined), and always count SYN and FIN as one sequence number each.

Q1. How many segments are exchanged during a normal TCP three-way handshake?

1. 2
2. 3
3. 4
4. 5

Answer and explanation

Correct answer: B. 3. SYN, SYN+ACK and ACK establish the connection.

Q2. Which flag is set in the first segment of an ordinary TCP active open?

1. FIN
2. RST
3. SYN
4. PSH

Answer and explanation

Correct answer: C. SYN. The client begins by sending SYN with its initial sequence number.

Q3. A SYN has SEQ=1200. What ACK does the peer send for this SYN?

1. 1200
2. 1201
3. 1199
4. 2400

Answer and explanation

Correct answer: B. 1201. A SYN consumes exactly one sequence number; ACK=1201.

Q4. Server SYN has SEQ=7000. What ACK should the client send?

1. 6999
2. 7000
3. 7001
4. 7002

Answer and explanation

Correct answer: C. 7001. ACK is the next expected sequence number: 7001.

Q5. A pure ACK carrying no payload, SYN or FIN advances the sender’s SEQ by:

1. 0
2. 1
3. 2
4. MSS

Answer and explanation

Correct answer: A. 0. A pure ACK does not occupy data sequence space.

Q6. Which normal state follows SYN-SENT after receiving a valid SYN+ACK?

1. CLOSE-WAIT
2. ESTABLISHED
3. FIN-WAIT-1
4. LAST-ACK

Answer and explanation

Correct answer: B. ESTABLISHED. The client sends the final ACK and transitions to ESTABLISHED.

Q7. Normal TCP connection release usually requires:

1. 1 segment
2. 2 segments
3. 3 segments only
4. 4 segments

Answer and explanation

Correct answer: D. 4 segments. A FIN and its ACK for each direction make four segments in the ordinary case.

Q8. When can TCP termination be completed in three segments?

1. When SYN is omitted
2. When the first FIN ACK and second FIN are combined
3. When TCP uses UDP
4. When sequence numbers are disabled

Answer and explanation

Correct answer: B. When the first FIN ACK and second FIN are combined. A combined FIN+ACK from the passive closer can reduce the total to three.

Q9. Which TCP control flag closes a sending direction gracefully?

1. FIN
2. RST
3. PSH
4. ECE

Answer and explanation

Correct answer: A. FIN. FIN marks the end of the sender’s byte stream in one direction.

Q10. Which TCP flag indicates an abrupt reset?

1. ACK
2. FIN
3. RST
4. URG

Answer and explanation

Correct answer: C. RST. RST is used for resets or refusal of connection attempts.

Q11. A FIN-only segment has SEQ=4500. Peer ACK should be:

1. 4500
2. 4501
3. 4502
4. 0

Answer and explanation

Correct answer: B. 4501. A FIN consumes one sequence number.

Q12. In an ordinary active close, the state after receiving ACK of own FIN is:

1. FIN-WAIT-2
2. CLOSE-WAIT
3. LAST-ACK
4. SYN-SENT

Answer and explanation

Correct answer: A. FIN-WAIT-2. After ACK of its FIN, the active closer waits for the peer FIN in FIN-WAIT-2.

Q13. After acknowledging an incoming FIN, but before locally closing, a passive closer is in:

1. SYN-RECEIVED
2. TIME-WAIT
3. CLOSE-WAIT
4. FIN-WAIT-1

Answer and explanation

Correct answer: C. CLOSE-WAIT. CLOSE-WAIT means the peer has finished but this endpoint has not yet sent its FIN.

Q14. Which state commonly follows sending the last ACK by an active closer?

1. LISTEN
2. TIME-WAIT
3. SYN-SENT
4. CLOSING

Answer and explanation

Correct answer: B. TIME-WAIT. The active closer enters TIME-WAIT to handle delayed packets or lost final ACK.

Q15. How many TCP connection-management states are listed in Tanenbaum Figure 6-38?

1. 8
2. 9
3. 10
4. 11

Answer and explanation

Correct answer: D. 11. Tanenbaum presents 11 states, including CLOSING and TIME-WAIT.

Q16. Two peers simultaneously initiate TCP connections between the same endpoints. This normally creates:

1. Zero connections
2. One connection
3. Two independent connections
4. A UDP association

Answer and explanation

Correct answer: B. One connection. Simultaneous open establishes one TCP connection for that endpoint pair.

Q17. TCP SYN flooding primarily attempts to exhaust:

1. DNS TTL
2. Half-open TCP connection resources
3. CPU cache tags
4. IP route entries

Answer and explanation

Correct answer: B. Half-open TCP connection resources. Incomplete SYN handshakes can accumulate server-side connection state.

Q18. A SYN cookie is primarily used to:

1. Encrypt application data
2. Remove all IP packet loss
3. Avoid allocating ordinary half-open state before valid ACK
4. Replace FIN with SYN

Answer and explanation

Correct answer: C. Avoid allocating ordinary half-open state before valid ACK. The server encodes information into its ISN and validates the returned ACK.

Q19. A client sends bytes SEQ=3001 to 4000 inclusive; next expected ACK is:

1. 3002
2. 4000
3. 4001
4. 5000

Answer and explanation

Correct answer: C. 4001. 1000 contiguous bytes starting at 3001 make the next expected byte 4001.

Q20. If bytes 1000–1499 arrive, bytes 1500–1999 are lost, and 2000–2499 arrive, cumulative ACK is:

1. 1500
2. 2000
3. 2500
4. 1000

Answer and explanation

Correct answer: A. 1500. Cumulative acknowledgement stops at the first missing in-order byte, 1500.

Q21. What is the key difference between TCP FIN and half-close?

1. A half-close sends no FIN
2. Half-close allows the FIN sender to continue receiving
3. A half-close uses RST
4. Half-close disables ACKs

Answer and explanation

Correct answer: B. Half-close allows the FIN sender to continue receiving. After the FIN, the sending direction closes; the opposite direction may still transfer data.

Q22. TCP sequence numbers operate modulo:

1. 2^8
2. 2^16
3. 2^24
4. 2^32

Answer and explanation

Correct answer: D. 2^32. The TCP sequence number field is 32 bits wide.

Q23. The server has received all client data through byte 9999 and receives a FIN at SEQ=10000. Its ACK becomes:

1. 9999
2. 10000
3. 10001
4. 10002

Answer and explanation

Correct answer: C. 10001. A FIN at SEQ 10000 consumes one sequence number, making ACK 10001.

Q24. Which statement about TIME_WAIT is most accurate?

1. It always lasts exactly 30 seconds
2. It supports final-ACK recovery and expiry of delayed duplicates
3. It occurs only during initial SYN
4. It is an application-layer timer

Answer and explanation

Correct answer: B. It supports final-ACK recovery and expiry of delayed duplicates. TIME_WAIT protects the terminated connection; textbook classical model describes 2×MSL, not a universal fixed duration.

12. Frequently Asked Questions

Why is the TCP handshake called three-way?

Because a normal active/passive connection establishment uses SYN, SYN+ACK and ACK, synchronizing both sides' initial sequence numbers.

Does a pure TCP ACK consume a sequence number?

No, not when it carries no data and neither SYN nor FIN is set. It acknowledges data from the opposite direction.

Why does a TCP SYN or FIN consume one sequence number?

It needs an ordered and acknowledgeable position in TCP's sequence space even if it carries no ordinary application data.

Is TCP termination always a four-way handshake?

No. The usual case requires four segments. ACK for the first FIN and the peer's FIN may be combined, making three segments. Simultaneous closes are also possible.

Which host enters TIME_WAIT?

In the normal termination sequence, the active closer that sends the last ACK enters TIME_WAIT. Simultaneous-close cases can involve both endpoints waiting.

What is the difference between SYN-SENT and SYN-RECEIVED?

SYN-SENT is normally the active opener after sending SYN. SYN-RECEIVED is normally the passive opener after receiving SYN and sending SYN+ACK.

What is SYN flooding?

Sending large numbers of SYN connection requests without completing handshakes, potentially exhausting a server's half-open connection resources.

Can TCP receive data after sending FIN?

Yes. FIN ends one direction of transmission; the sending endpoint can still receive until the peer closes its direction.

Why is TIME_WAIT used?

It helps handle retransmission of a lost final ACK and prevents delayed duplicates from an old connection from contaminating later connections.

Is TCP a physical circuit?

No. It is a logical connection over the best-effort IP network. The underlying packets can be routed independently.

13. Textbook References and Exam Coverage

• Andrew S. Tanenbaum and David J. Wetherall, Computer Networks, 5th ed. §6.2.2–6.2.3 (connection establishment/release), §6.5.5 (three-way handshake, pp.560–561), §6.5.6 (termination, p.562), §6.5.7 (11 TCP states and state machine, pp.562–565). Figures 6-37, 6-38 and 6-39.
• Behrouz A. Forouzan, Data Communications and Networking, 4th ed. §23.3, especially TCP connection establishment, data transfer, simultaneous open, SYN flooding, termination and half-close (pp.723–729). Figures 23.18, 23.20 and 23.21.
• Exam alignment: APPSC Assistant Professor CSE (Computer Networks, TCP/IP model and congestion control); APPSC IT Engineering and RGUKT IT (TCP/UDP, sockets and related transport mechanisms); conceptual and numerical preparation relevant to UGC NET and GATE.

Scope: This lesson explains classical TCP mechanisms as presented in the two books; actual modern TCP stacks can include additional features and implementation-specific behavior. All diagrams, exercises and quiz questions are independently created for this tutorial.

Coming next — Lesson 07: TCP sliding window, flow control, receive window, cumulative acknowledgements and window-based numerical problems.