Ravindra BagaleCourses & study guides

3. OSI Model, TCP/IP Model, TCP vs UDP and the 3-Way Handshake

3.5 The TCP 3-Way Handshake, TCP Flags and Connection Close

By Last updated:

Ha chapter cha sagalyat important topic – dhyan dya. TCP connection suru honyapurvi don machines "hello" boltat. He teen steps lakshat theva – Nmap che scan types, SYN flood attack, firewall states, Wireshark madhli analysis – sagla ya handshake var aadharit aahe.

   Client (192.168.56.10:51544)                 Server (192.168.56.101:80)
        |  1. SYN        seq=1000                        |
        | ---------------------------------------------> |   "I want to talk"
        |  2. SYN-ACK    seq=5000, ack=1001              |
        | <--------------------------------------------- |   "OK, I heard you"
        |  3. ACK        seq=1001, ack=5001              |
        | ---------------------------------------------> |   connection ESTABLISHED
        |        ... data (PSH/ACK) both ways ...        |
        |  FIN  ---------------------------------------> |   4-way close:
        |  <---------------------------------------  ACK |   FIN, ACK, FIN, ACK
        |  <---------------------------------------  FIN |
        |  ACK  ---------------------------------------> |
Flag Meaning Where you meet it
SYN Synchronise – start a connection Handshake step 1 and 2, SYN scan (nmap -sS)
ACK Acknowledge received data Every packet after the first
FIN Finish – graceful close ("I have finished sending") Connection close, FIN scan
RST Reset – abort immediately Reply from a closed port
PSH Push data to the application now Interactive traffic
URG Urgent pointer valid Rare; Xmas scan sets FIN+PSH+URG

How ports answer a SYN (this is how Nmap decides):

Probe Server replies Nmap says
SYN SYN-ACK open
SYN RST closed (host is up)
SYN Nothing / ICMP unreachable filtered (a firewall or security group dropped it) 
sudo tcpdump -i any -nn 'tcp port 80 and (tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0)'
# in another terminal: curl -s http://localhost > /dev/null   -> watch SYN, SYN-ACK, FIN

Why this matters for security

A SYN flood sends thousands of SYNs and never completes step 3, filling the server's half-open connection table; defences are SYN cookies, rate limits and cloud DDoS protection such as AWS Shield. A SYN (half-open) scan sends SYN, reads the reply and sends RST instead of ACK – that is nmap -sS, the default scan when run as root. Filtered vs closed also tells an attacker whether a firewall is present.

Ravindra Bagale's Tip

When explaining the handshake, many students say the order backwards: "SYN, ACK, SYN-ACK". The correct order is SYN → SYN-ACK → ACK, and ack = received seq + 1 – the ACK means "I want the next byte". And don't say a closed port gives "no reply" – a closed port sends RST; "no reply" means filtered. When you explain this, the interviewer knows you didn't just memorise it.

Practice task

Run the tcpdump command above on a lab machine with a web server, then open the page with curl. Identify the SYN, SYN-ACK and ACK lines and the FIN/RST at the end.